UBUNTU-CVE-2026-88924

A flaw was found in the admin backend of gvfs. The privileged gvfsd-ad...

CVE-2026-88924

A flaw was found in the admin backend of gvfs. The privileged gvfsd-ad...

DEBIAN-CVE-2026-88924

A flaw was found in the admin backend of gvfs. The privileged gvfsd-admin daemon changes the ownership of newly created private D-Bus sockets by calling the link-following chown function on a pathname inside a user-controlled directory. A local attacker can exploit this via a Time-of-Check...

CVE-2026-88924

A flaw was found in the admin backend of gvfs. The privileged gvfsd-admin daemon changes the ownership of newly created private D-Bus sockets by calling the link-following chown function on a pathname inside a user-controlled directory. A local attacker can exploit this via a Time-of-Check...

CVE-2026-88924

A Time-of-Check Time-of-Use (TOCTOU) race condition exists in the gvfsd-admin daemon of gvfs (GNOME Virtual Filesystem). The privileged daemon calls the link-following chown() on a socket pathname inside a user-controlled directory; a local attacker can replace that pathname with a symbolic link ...

EUVD-2026-75537

A flaw was found in the admin backend of gvfs. The privileged gvfsd-admin daemon changes the ownership of newly created private D-Bus sockets by calling the link-following chown function on a pathname inside a user-controlled directory. A local attacker can exploit this via a Time-of-Check...

CVE-2026-88924 Gvfs: gvfs-admin socket ownership race permits local root

A flaw was found in the admin backend of gvfs. The privileged gvfsd-admin daemon changes the ownership of newly created private D-Bus sockets by calling the link-following chown function on a pathname inside a user-controlled directory. A local attacker can exploit this via a Time-of-Check...

Linux Distros Unpatched Vulnerability : CVE-2026-88924

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in the admin backend of gvfs. The privileged gvfsd-admin daemon changes the ownership of newly created private D-Bus sockets by calling the...

PT-2026-89458

A flaw was found in the admin backend of gvfs. The privileged gvfsd-admin daemon changes the ownership of newly created private D-Bus sockets by calling the link-following chown function on a pathname inside a user-controlled directory. A local attacker can exploit this via a Time-of-Check...

UBUNTU-CVE-2026-84267

A flaw was found in the SFTP backend in gvfs. When mounting a share, a...

CVE-2026-84267

A flaw was found in the SFTP backend in gvfs. When mounting a share, a...

CVE-2026-84268

A flaw was found in the SFTP backend in gvfs. When mounting a share an...

CVE-2026-84269

A flaw was found in the AFP backend in gvfs. When mounting a share, a...

UBUNTU-CVE-2026-84268

A flaw was found in the SFTP backend in gvfs. When mounting a share an...

UBUNTU-CVE-2026-84270

A flaw was found in the MTP backend in gvfs. When reading a file from...

UBUNTU-CVE-2026-84269

A flaw was found in the AFP backend in gvfs. When mounting a share, a...

CVE-2026-84270

A flaw was found in the MTP backend in gvfs. When reading a file from...

CVE-2026-84267

A flaw was found in the SFTP backend in gvfs. When mounting a share, a malicious SFTP server can cause readstring to allocate a buffer with a certain length but the function does not verify that the buffer is completely filled, leaving the remainder of the buffer containing uninitialized heap...

CVE-2026-84269

A flaw was found in the AFP backend in gvfs. When mounting a share, a malicious AFP server can cause the DSI read path to process a length that exceeds the size requested by the client. The function does not verify the server-provided length against the pre-sized reply buffer, causing the operati...

DEBIAN-CVE-2026-84267

A flaw was found in the SFTP backend in gvfs. When mounting a share, a malicious SFTP server can cause readstring to allocate a buffer with a certain length but the function does not verify that the buffer is completely filled, leaving the remainder of the buffer containing uninitialized heap...