CVE Tracker

CVE-2026-54230 @ mufasa

Status
mitigating
Priority
6.12
Match score
3.0
Risk
Other priv:root
CVSS
7.0 HIGH
Reason
cpe: abrt; pkgs: abrt; version: unknown (abrt-2.1.11-60.el7.cloudlinux; abrt-addon-ccpp-2.1.11-60.el7.cloudlinux; abrt-addon-kerneloops-2.1.11-60.el7.cloudlinux; abrt-addon-pstoreoops-2.1.11-60.el7.cloudlinux)
Created
2026-08-03T18:23:43Z
Updated
2026-08-22T10:15:57Z

Package interrogation (copy)

Run on the host — click to copy a command. RPM

PackageCommands
abrt-2.1.11-60.el7.cloudlinux
abrt-addon-ccpp-2.1.11-60.el7.cloudlinux
abrt-addon-kerneloops-2.1.11-60.el7.cloudlinux
abrt-addon-pstoreoops-2.1.11-60.el7.cloudlinux

Inventory lookup

Search package inventory across systems, then return here. Create a ticket on systems the matcher missed.

Clear

Suggestions: abrt · abrt-addon-ccpp · abrt-addon-kerneloops · abrt-addon-pstoreoops

SystemMatchesTicket for CVE-2026-54230
mufasa abrt-addon-kerneloops 2.1.11 mitigating open

Related CVE (same fix)

Point this ticket’s CVE at a higher-priority / same-fix primary so you only triage one.

Host OS / kernel

OS
CloudLinux release 7.9 (Boris Yegorov) (7.9) · cloudlinux
Arch
x86_64
kernel_release
uname -r → 3.10.0-962.3.2.lve1.5.89.el7.x86_64
kernel_version
uname -v → #1 SMP Thu Jul 9 15:55:31 UTC 2026

For Linux kernel CVEs, kernel_version (Debian packaging / build string) often decides fixed vs not; kernel_release is used for upstream NVD range compares.

Description

A symlink following vulnerability was found in the ABRT post-create event handler scripts in libreport. Event scripts write output files using shell redirections without the O_NOFOLLOW flag. If the target file is replaced with a symlink, the shell process running as root follows the symlink and writes content to the symlink target, allowing arbitrary file overwrites on the system.

Determination

Issue: Symlink following vulnerability in ABRT (Automatic Bug Reporting Tool) post-create event handler scripts (in libreport).
Details: The scripts write output files using shell redirections without the O_NOFOLLOW flag. 
A local attacker can replace the target with a symlink, causing the root-owned process to overwrite arbitrary files.
Impact: Local privilege escalation (arbitrary file overwrite as root).
Have Stopped Services. 
Will Remove Packages (Soon)

Update status

Add note only

Mitigation log

2026-08-03T18:31:03Z — affects
Issue: Symlink following vulnerability in ABRT (Automatic Bug Reporting Tool) post-create event handler scripts (in libreport). Details: The scripts write output files using shell redirections without the O_NOFOLLOW flag. A local attacker can replace the target with a symlink, causing the root-owned process to overwrite arbitrary files. Impact: Local privilege escalation (arbitrary file overwrite as root).
2026-08-03T19:03:05Z
Not installed on Morris. Not actually needed. 3 reports - Crash Data stored locally: /var/spool/abrt/
2026-08-03T19:06:50Z
systemctl stop abrtd abrt-ccpp abrt-oops abrt-vmcore abrt-xorg systemctl disable abrtd abrt-ccpp abrt-oops abrt-vmcore abrt-xorg Next Steps: # Remove the packages yum remove abrt abrt-addon-* libreport yum remove abrt abrt-* libreport libreport-*
2026-08-03T19:11:50Z — mitigating
Have Stopped Services. Will Remove Packages (Soon)

References

NVD: CVE-2026-54230