USN-8970-1: Three GVfs vulnerabilities on Ubuntu, from data leaks to DoS

Ubuntu released security notice USN-8970-1 on 3 November 2026, addressing three vulnerabilities in GVfs, the userspace virtual filesystem layer used by GNOME to mount remote resources (SFTP, SMB, AFP, MTP devices) as if they were local folders. Anyone managing Ubuntu workstations with GNOME desktop, or development machines with GNOME Files (Nautilus) active, should apply the patch.

The three flaws

According to the official Ubuntu notice, GVfs was found to be incorrectly validating data returned by an SFTP server, and a remote attacker could potentially use this issue to obtain sensitive information (CVE-2026-84267). Similarly, GVfs was not correctly validating the size of responses from an AFP server, and a remote attacker could potentially use this to trigger a denial of service (CVE-2026-84269). The third flaw: GVfs was not properly validating the size of data returned by an MTP device, and an attacker with a malicious MTP device could potentially use this to cause a denial of service (CVE-2026-84270).

The practical target: a client mounting an SFTP or AFP share controlled by a hostile server, or a specially-crafted MTP flash drive or phone connected to the machine.

Fixed versions and how to update

Ubuntu Release	Codename	gvfs package version
26.04 LTS	resolute	1.60.0-1ubuntu0.2
24.04 LTS	noble	1.54.4-0ubuntu1~24.04.5
22.04 LTS	jammy	1.48.2-0ubuntu1.3

After a standard system update, you need to restart your user session to make all changes take effect, as outlined in the notice instructions.

Who actually needs to worry

GVfs is a GNOME desktop component, not a service typically found on headless servers: anyone managing only VPS or boxes without a graphical interface can disregard the notice. It remains relevant for those administering development workstations, office desktops running GNOME, or Ubuntu Pro desktop images used in production.

Ubuntu Pro, the notice reminds us, provides a decade of security coverage for over 25,000 packages from the Main and Universe repositories, free for up to five machines.