[HIGH PRIORITY] Red Hat ABRT libreport Content Injection (CVE-2026-54231)

⚠ HIGH PRIORITY — Red Hat 2026 advisory. CVE-2026-54231 is a content injection flaw in ABRT/libreport event handler scripts. Local users embed newline characters in syslog messages to control content that root writes to ABRT dump directory files — enabling further privilege escalation on RHEL 8 and Fedora.

Affected systems

• Red Hat Enterprise Linux 8 with ABRT/libreport installed
• Fedora 43 and Fedora 44 shipping ABRT
• NOT affected: RHEL 9+ (ABRT removed/deprecated)

Check exposure

rpm -q libreport abrt 2>/dev/null
systemctl is-enabled abrtd 2>/dev/null
ls /var/spool/abrt/ 2>/dev/null

Patching Method

1. Apply latest libreport/abrt security update from Red Hat/Fedora advisories.
2. Recommended: disable and remove ABRT on RHEL 8:
3. systemctl disable --now abrtd abrt-journal-core abrt-oops abrt-xorg
4. dnf remove abrt libreport-cli libreport-plugin-*
5. Migrate crash handling to systemd-coredump (default on RHEL 9).
6. Audit dump directories for injected content and unexpected root-owned files.
7. Review journal logs for crafted syslog messages with embedded newlines.

systemctl disable --now abrtd.service abrt-journal-core.service
coredumpctl list | tail -5

Until patched

• Disable abrtd on all RHEL 8 / Fedora servers immediately
• Do not rely on ABRT for production crash collection
• Limit local user ability to inject syslog messages where feasible

CWE: CWE-74 Injection. Remove ABRT rather than deferring patch.