Back to Security Advisories

GNOME Shell Vulnerability — Ubuntu Security Update (USN-8971-1)

USN-8971-1 fixes a GNOME Shell flaw where icon dimensions from a remote search provider were not validated — crafted input can crash GNOME Shell (denial of service) or expose sensitive information (CVE in the notice; CVSS 6.1). Update: sudo apt update && sudo apt upgrade gnome-shell and restart the session.

High 6.1 CVSS
Ubuntu 20.04 Ubuntu 22.04

What this means under a SharedLicense license

GNOME Shell owns the whole desktop session — a crash logs the user out of everything, and an information leak inside the shell can expose data from every open application.

  1. Ubuntu Security Notices

  2. USN-8971-1

Publication date

3 November 2026

Overview

GNOME Shell could be made to crash or expose sensitive information if
it received specially crafted input.

Releases


26.04 LTS


24.04 LTS


22.04 LTS

Packages

  • gnome-shell – graphical shell for the GNOME desktop

Details

It was discovered that GNOME Shell did not properly validate icon
dimensions when processing icons from a remote search provider. An
attacker could possibly use this issue to cause GNOME Shell to crash,
resulting in a denial of service, or expose sensitive information from
memory.

It was discovered that GNOME Shell did not properly validate icon
dimensions when processing icons from a remote search provider. An
attacker could possibly use this issue to cause GNOME Shell to crash,
resulting in a denial of service, or expose sensitive information from
memory.

Update instructions

After a standard system update you need to restart your session to make
all the necessary changes.

Learn more about how to get the fixes.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release Package Version
26.04

LTS resolute

 gnome-shell – 

50.1-0ubuntu1.5
24.04

LTS noble

 gnome-shell – 

46.0-0ubuntu6~24.04.17
22.04

LTS jammy

 gnome-shell – 

42.9-0ubuntu2.4

References

Frequently Asked Questions

What is USN-8971-1?
It is Ubuntu's GNOME Shell security notice: icon dimensions from a remote search provider were not properly validated, allowing denial of service or sensitive-information exposure. CVSS 6.1; fixed in the notice's updated gnome-shell package.
Who is affected?
Ubuntu desktops using GNOME Shell with remote search providers enabled — the flaw triggers on crafted provider results shown in the Shell search. Servers without GNOME are unaffected.
How do I apply the fix?
Run sudo apt update && sudo apt upgrade gnome-shell and log out/in (or restart the session) so the patched Shell is loaded.
What is a remote search provider?
A component whose results appear in the desktop search bar — the Shell renders icons and text it supplies, which is why unvalidated dimensions from it could crash or leak from the Shell process.

References

Security Advisories

Related Advisories

Tornado Regression — Ubuntu Security Update (USN-8952-3)

2026-11-11

Linux Kernel (Azure CVM) Vulnerabilities — Ubuntu Security Update (USN-9039-1)

2026-11-11

Linux Kernel (Low Latency NVIDIA) Vulnerabilities — Ubuntu Security Update (USN-9040-1)

2026-11-11

Check your system for vulnerabilities

Select your product and operating system to see the exact fix commands that apply to you.

Check Your System