USN-8845-1: GVfs vulnerabilities
Ubuntu warns of two GVfs flaws: malicious SFTP input may yield code execution, and a local bug can grant root.
Ubuntu security notice USN-8845-1 describes two GVfs vulnerabilities. CVE-2026-84268, discovered by Keith Linneman, is improper validation of data from SFTP servers that can cause a heap buffer overflow and potentially arbitrary code execution or denial of service. CVE-2026-88924 is incorrect ownership handling when creating private D-Bus sockets in the admin backend, letting a local attacker change ownership of arbitrary system files and escalate to root. That privilege-escalation issue affects only Ubuntu 22.04 LTS, 24.04 LTS, and 26.04 LTS. The notice does not report observed exploitation.
- CVE-2026-84268 is a heap overflow from malicious SFTP data, enabling code execution or denial of service.
- CVE-2026-88924 lets a local user change ownership of arbitrary files and escalate to root.
- The root flaw affects only Ubuntu 22.04 LTS, 24.04 LTS, and 26.04 LTS.
- The notice does not report exploitation in the wild.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-84268 | Heap Buffer Overflow in GNOME gvfs SFTP Backend via Malicious SFTP Server | 8.8 | <1% | ||
| CVE-2026-88924 | TOCTOU symlink race in gvfs gvfsd-admin daemon allows local privilege escalation to root | 7.0 | — |
From the original article
Keith Linneman discovered that GVfs did not properly validate data received from SFTP servers. An attacker could possibly use this issue to cause a heap buffer overflow, resulting in arbitrary code execution or a denial of service. (CVE-2026-84268) It was discovered that GVfs incorrectly handled file ownership when creating private D-Bus sockets in the admin backend.
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.