Summary
Keith Linneman discovered that GVfs did not properly validate data
received from SFTP servers. An attacker could possibly use this issue to
cause a heap buffer overflow, resulting in arbitrary code execution or a
denial of service. (CVE-2026-84268)
It was discovered that GVfs incorrectly handled file ownership when
creating private D-Bus sockets in the admin backend. A local attacker
could possibly use this issue to change the ownership of arbitrary
system files, resulting in privilege escalation to root. This issue only
affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS.
(CVE-2026-88924)
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | gvfs | 1.48.2-0ubuntu1.2 |
| Ubuntu · 24.04 LTS 24.04:LTS | gvfs | 1.54.4-0ubuntu1~24.04.4 |
| Ubuntu · 26.04 LTS 26.04:LTS | gvfs | 1.60.0-1ubuntu0.1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | gvfs | 1.28.2-1ubuntu1~16.04.3+esm1 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | gvfs | 1.36.1-0ubuntu1.3.3+esm1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | gvfs | 1.44.1-1ubuntu1.2+esm1 |
Vulnerabilities 2
-
High 8.8
Gvfs: sftp: heap-based buffer overflow in read_reply()
A flaw was found in the SFTP backend in gvfs. When mounting a share and reading a file, a malicious SFTP server can cause read_reply() to process a length that exceeds the size requested by the client. The function does not verify the server-provided length a…
-
High 7.0
Gvfs: gvfs-admin socket ownership race permits local root
A flaw was found in the admin backend of gvfs. The privileged gvfsd-admin daemon changes the ownership of newly created private D-Bus sockets by calling the link-following chown() function on a pathname inside a user-controlled directory. A local attacker can…