Red Hat Security Advisory: gvfs security update

Fixed packages 15

Vulnerabilities 2

• High 8.8
  CVE-2026-84268

  Gvfs: sftp: heap-based buffer overflow in read_reply()

  A flaw was found in the SFTP backend in gvfs. When mounting a share and reading a file, a malicious SFTP server can cause read_reply() to process a length that exceeds the size requested by the client. The function does not verify the server-provided length a…

  Red Hat GNOME Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Linux Debian Ubuntu
  Sep 1, 2026
• High 7.0
  CVE-2026-88924

  Gvfs: gvfs-admin socket ownership race permits local root

  A flaw was found in the admin backend of gvfs. The privileged gvfsd-admin daemon changes the ownership of newly created private D-Bus sockets by calling the link-following chown() function on a pathname inside a user-controlled directory. A local attacker can…

  Red Hat GNOME Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Linux Debian Ubuntu
  Sep 10, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2526485
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2531456
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_85941.json
• report
  https://access.redhat.com/security/cve/CVE-2026-84268
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-84268
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-84268
• article
  https://gitlab.gnome.org/GNOME/gvfs/-/issues/862
• report
  https://access.redhat.com/security/cve/CVE-2026-88924
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-88924
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-88924
• article
  https://gitlab.gnome.org/GNOME/gvfs/-/issues/875