Packages
- gvfs - Userspace virtual file system
Details
Keith Linneman discovered that GVfs did not properly validate data
received from SFTP servers. An attacker could possibly use this issue to
cause a heap buffer overflow, resulting in arbitrary code execution or a
denial of service. (CVE-2026-84268)
It was discovered that GVfs incorrectly handled file ownership when
creating private D-Bus sockets in the admin backend. A local attacker
could possibly use this issue to change the ownership of arbitrary
system files, resulting in privilege escalation to root. This issue only
affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS.
(CVE-2026-88924)
Keith Linneman discovered that GVfs did not properly validate data
received from SFTP servers. An attacker could possibly use this issue to
cause a heap buffer overflow, resulting in arbitrary code execution or a
denial of service. (CVE-2026-84268)
It was discovered that GVfs incorrectly handled file ownership when
creating private D-Bus sockets in the admin backend. A local attacker
could possibly use this issue to change the ownership of arbitrary
system files, resulting in privilege escalation to root. This issue only
affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS.
(CVE-2026-88924)
Update instructions
After a standard system update you need to restart your session to make all the necessary changes.
Learn more about how to get the fixes.The problem can be corrected by updating your system to the following package versions:
| Ubuntu Release | Package Version | ||
|---|---|---|---|
| 26.04 LTS resolute | gvfs-backends – 1.60.0-1ubuntu0.1 | ||
| gvfs-libs – 1.60.0-1ubuntu0.1 | |||
| 24.04 LTS noble | gvfs-backends – 1.54.4-0ubuntu1~24.04.4 | ||
| gvfs-libs – 1.54.4-0ubuntu1~24.04.4 | |||
| 22.04 LTS jammy | gvfs-backends – 1.48.2-0ubuntu1.2 | ||
| gvfs-libs – 1.48.2-0ubuntu1.2 | |||
| 20.04 LTS focal | gvfs-backends – 1.44.1-1ubuntu1.2+esm1 | ||
| gvfs-libs – 1.44.1-1ubuntu1.2+esm1 | |||
| 18.04 LTS bionic | gvfs-backends – 1.36.1-0ubuntu1.3.3+esm1 | ||
| gvfs-libs – 1.36.1-0ubuntu1.3.3+esm1 | |||
| 16.04 LTS xenial | gvfs-backends – 1.28.2-1ubuntu1~16.04.3+esm1 | ||
| gvfs-libs – 1.28.2-1ubuntu1~16.04.3+esm1 | |||
Reduce your security exposure
Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.