Zurück zu den Sicherheitshinweisen

GVfs Vulnerabilities — Ubuntu Security Update (USN-8970-1)

USN-8970-1 fixes three GVfs vulnerabilities on Ubuntu: improper validation of SFTP server responses allowing sensitive-information disclosure (CVE-2026-84267), improper reply-size validation, and a third parsing flaw. Update: sudo apt update && sudo apt upgrade gvfs and restart GVfs-using sessions.

High 4.3 CVSS
Ubuntu 20.04 Ubuntu 22.04

Was das unter einer SharedLicense-Lizenz bedeutet

GVfs mounts remote file systems (SFTP, SMB) for desktop applications — a malicious or compromised file server can leak memory contents of every client application reading through the mount.

  1. Ubuntu Security Notices

  2. USN-8970-1

Publication date

3 November 2026

Overview

Several security issues were fixed in GVfs.

Releases


26.04 LTS


24.04 LTS


22.04 LTS

Packages

  • gvfs – Userspace virtual file system

Details

It was discovered that GVfs did not properly validate data returned by
an SFTP server. A remote attacker could possibly use this issue to
obtain sensitive information.
(CVE-2026-84267)

It was discovered that GVfs did not properly validate the size of
replies from an AFP server. A remote attacker could possibly use this
issue to cause a denial of service.
(CVE-2026-84269)

It was discovered that GVfs did not properly validate the size of data
returned by an MTP device. An attacker with a malicious MTP device
could possibly use this issue to cause a denial of service.
(CVE-2026-84270)

It was discovered that GVfs did not properly validate data returned by
an SFTP server. A remote attacker could possibly use this issue to
obtain sensitive information.
(CVE-2026-84267)

It was discovered that GVfs did not properly validate the size of
replies from an AFP server. A remote attacker could possibly use this
issue to cause a denial of service.
(CVE-2026-84269)

It was discovered that GVfs did not properly validate the size of data
returned by an MTP device. An attacker with a malicious MTP device
could possibly use this issue to cause a denial of service.
(CVE-2026-84270)

Update instructions

After a standard system update you need to restart your session to make
all the necessary changes.

Learn more about how to get the fixes.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release Package Version
26.04

LTS resolute

 gvfs – 

1.60.0-1ubuntu0.2
24.04

LTS noble

 gvfs – 

1.54.4-0ubuntu1~24.04.5
22.04

LTS jammy

 gvfs – 

1.48.2-0ubuntu1.3

References

Häufig gestellte Fragen

What is USN-8970-1?
It is Ubuntu's GVfs security notice fixing three CVEs: improper validation of SFTP server data allowing sensitive-information disclosure (CVE-2026-84267), improper reply-size validation, and a related parsing flaw — rated 4.3 aggregate.
Who is affected?
Ubuntu desktops and workstations using GVfs mounts (SFTP/SSH file browsing in the file manager) that connect to remote file servers — the server's responses are the attack input.
How do I apply the fix?
Run sudo apt update && sudo apt upgrade gvfs and unmount/remount any active GVfs mounts so the patched library is used.
Is this relevant on servers?
Rarely — GVfs is a desktop virtual-filesystem layer. Headless servers without a desktop session do not run it; the exposure is on workstations connecting to untrusted file servers.

Referenzen

Sicherheitshinweise

Verwandte Warnhinweise

Tornado Regression — Ubuntu Security Update (USN-8952-3)

2026-11-11

Linux Kernel (Azure CVM) Vulnerabilities — Ubuntu Security Update (USN-9039-1)

2026-11-11

Linux Kernel (Low Latency NVIDIA) Vulnerabilities — Ubuntu Security Update (USN-9040-1)

2026-11-11

System auf Schwachstellen prüfen

Wählen Sie Ihr Produkt und Betriebssystem, um die passenden Fix-Befehle zu sehen.

System prüfen