On this page (7 sections)
Ubuntu has published USN-8970-1, a security notice covering three vulnerabilities in GVfs, the virtual file system layer used by GNOME and many Linux desktops to mount remote shares and devices. The flaws sit in the SFTP, AFP and MTP backends and are all rated medium severity.
If you run Ubuntu desktops or workstations where people mount SFTP or AFP shares, or plug in phones and other MTP devices, you should check for updates. Pure headless web servers are less likely to be exposed, but it is worth confirming whether GVfs is installed at all.
What happened
GVfs runs a small helper process for each kind of mount. When a user connects to a remote share or a device, that helper parses data sent back by the other side. In all three cases, the helper trusted a length or content supplied by the remote party without checking it properly. Ubuntu's notice summarizes the three issues in one place, and the GitHub Advisory Database entries carry the technical descriptions.
The three vulnerabilities
| CVE | Backend | Weakness | CVSS | Impact |
|---|---|---|---|---|
| CVE-2026-84267 | SFTP (gvfsd-sftp) | CWE-908, use of uninitialized resource | 4.3 | Information disclosure, weakens ASLR |
| CVE-2026-84269 | AFP (gvfsd-afp) | CWE-122, heap-based buffer overflow | 6.5 | Denial of service (process crash) |
| CVE-2026-84270 | MTP (gvfsd-mtp) | CWE-125, out-of-bounds read | 4.3 | Denial of service (process crash) |
CVE-2026-84267: SFTP uninitialized memory leak
Per the advisory text, a malicious SFTP server can send a short file handle reply. The client allocates a buffer but does not confirm it was completely filled, so the leftover bytes come from uninitialized heap memory. The client then echoes those bytes back to the server on later requests using that handle. With a 128-byte length, the server can read heap contents deterministically, learning the heap base and the load address of the libgio library. That defeats ASLR, a protection that makes follow-on memory attacks harder. On its own this is a leak, not code execution, and the sources do not describe a chained attack.
CVE-2026-84269: AFP heap overflow
A malicious AFP server can return a data length larger than the size the client asked for. The advisory says the code does not compare that length with the pre-sized reply buffer, so a heap buffer is overflowed and the gvfsd-afp process crashes. The documented result is denial of service. It carries the highest score of the three, 6.5, because its availability impact is rated high and its attack vector is the network.
CVE-2026-84270: MTP out-of-bounds read
When reading a file from a mounted MTP device, gvfsd-mtp trusts the length the device returns and passes it to memcpy(). A malicious device that returns more bytes than requested causes an out-of-bounds read and a segmentation fault, crashing gvfsd-mtp. The advisory rates the attack vector as physical, since the attacker must get a malicious device plugged in.
Who is realistically exposed
All three scores list user interaction as required: someone has to mount the share or read a file from the device. The practical impact is a crashed helper process or a memory layout leak, not a direct takeover, based on the descriptions in the sources. The EPSS estimates shown on the GitHub entries are low (0.368%, 0.452% and 0.219%), and no source reports active exploitation.
How to check your systems
First, see whether GVfs packages are installed on an Ubuntu host. This read-only command lists installed packages whose names contain gvfs. No output means GVfs is not installed.
dpkg -l | grep -i gvfsNext, refresh package lists and see whether updates are pending for those packages. Compare the versions offered with the fixed versions in the Ubuntu notice for your release.
sudo apt update
apt list --upgradable 2>/dev/null | grep -i gvfsWhat to do now
0 of 7 done
To install the update on Ubuntu, run the standard apt upgrade. Note that this command upgrades every installed package that has an update available, including the GVfs packages, not only GVfs.
sudo apt update && sudo apt upgradeDetection and monitoring afterwards
- Watch for repeated crashes of gvfsd-sftp, gvfsd-afp or gvfsd-mtp in the system journal or crash reports. Repeated crashes right after mounting a particular server or device are a useful signal.
- Treat unexpected prompts to mount a share, or unfamiliar servers appearing in a user's file manager bookmarks, as worth a look.
- Keep an inventory of which machines run a desktop environment, since these are the ones this notice affects and they are often missed by server-focused patching.
If you also run public websites, keep their patching and exposure checks going alongside desktop updates. A free SSL certificate checker and security headers checker are quick ways to review the public side, and our small business website security guide covers the wider routine.
Caveats on the sources
The GitHub advisory entries are marked unreviewed and list affected and patched versions as unknown, so rely on the Ubuntu notice for version details.
Sources
This article is based on the public sources below. Details can change as vendors and researchers publish more; check the original advisories before acting on version numbers.