On this page (6 sections)
Ubuntu published security notice USN-8971-1 on 3 November 2026 for a vulnerability in GNOME Shell, the graphical shell of the GNOME desktop. According to the Ubuntu notice, the shell could crash or expose sensitive information from memory if it received specially crafted input.
This matters most to anyone running Ubuntu with a GNOME desktop: developers, administrators with graphical workstations and teams that use Ubuntu desktops to manage servers and websites. If you are not sure whether a machine has the package, the check below takes a few seconds.
What happened
Ubuntu says GNOME Shell did not properly validate icon dimensions when it processed icons coming from a remote search provider. Search providers let the shell show results from other applications in the overview search. When one of them supplies an icon, the shell has to check that its size is sane before using it.
Per the notice, an attacker could possibly use the issue to make GNOME Shell crash, causing a denial of service, or to expose sensitive information from memory. The wording "possibly" is Ubuntu's, and the notice gives no further exploit conditions.
The weakness in plain terms
Missing validation of dimensions is a classic input-handling mistake. If a program trusts a width or height supplied by another component, it may read more memory than it should. The two outcomes Ubuntu lists fit that general pattern: a crash, or a leak of data from memory. The notice itself does not classify the bug any further.
No CVSS score or attack vector is given in the research. Treat the exact severity as unknown until a scoring authority publishes a rating for CVE-2026-91786.
Who is affected
- Ubuntu 26.04 LTS (resolute), 24.04 LTS (noble) and 22.04 LTS (jammy) systems with the gnome-shell package installed.
- Shared workstations and developer machines where a crash of the shell would interrupt work.
- Any machine where the desktop session is in use, since the notice mentions possible exposure of information from memory.
Other Ubuntu releases and other distributions are not covered by this notice. If you run another distribution, check its own security tracker rather than assuming the same fix applies.
How to check your exposure
This read-only command lists the installed gnome-shell package and its version on Ubuntu. Compare the version in the output with the table below. If the package is not installed, dpkg reports that no packages were found and this notice does not apply to the machine.
dpkg -l gnome-shell| Ubuntu release | Codename | Fixed gnome-shell version |
|---|---|---|
| 26.04 LTS | resolute | 50.1-0ubuntu1.5 |
| 24.04 LTS | noble | 46.0-0ubuntu6~24.04.17 |
| 22.04 LTS | jammy | 42.9-0ubuntu2.4 |
If your installed version is older than the one listed for your release, you should update. If it matches or is newer, the fix is already in place.
What to do now
Ubuntu states that a standard system update fixes the problem, and that you need to restart your session afterwards so the changes take effect. These commands refresh the package lists and upgrade only the gnome-shell package on Ubuntu.
sudo apt update
sudo apt install --only-upgrade gnome-shellAfter updating and logging back in, rerun the version check to confirm you now have the fixed package.
0 of 6 done
Monitoring and follow-up
The notice does not report active exploitation, but that only reflects what Ubuntu has published so far. Keep an eye on the Ubuntu notice and the CVE record for CVE-2026-91786 for a severity score or later changes.
If you manage websites from Ubuntu desktops, remember that a compromised workstation can be a route to your sites. Our guides on small business website security and checking whether a website is hacked cover what to review if you suspect something. Webforta's security scanner can also run read-only scans of websites you verify, which is a separate layer from patching desktop software.
Sources
This article is based on the public sources below. Details can change as vendors and researchers publish more; check the original advisories before acting on version numbers.