CVE-2026-84268: gvfs SFTP Backend RCE Vulnerability

CVE-2026-84268 Overview

CVE-2026-84268 is a heap buffer overflow [CWE-122] in the SFTP backend of GNOME Virtual File System (gvfs). When a client mounts a share and reads a file, the read_reply() function trusts the server-provided length without validating it against the client-allocated buffer size. A malicious SSH File Transfer Protocol (SFTP) server can return an oversized length value, causing gvfsd-sftp to write past the intended heap boundary. The result is heap corruption in the gvfsd-sftp process, leading to a process abort or potentially arbitrary code execution in the user session.

Critical Impact

A malicious or compromised SFTP server can corrupt heap memory in gvfsd-sftp on a connecting Linux desktop, causing denial of service or enabling code execution in the user context.

Affected Products

• GNOME gvfs SFTP backend (gvfsd-sftp)
• Linux desktop distributions shipping vulnerable gvfs builds
• Red Hat Enterprise Linux (see Red Hat CVE-2026-84268 Advisory)

Discovery Timeline

• 2026-09-01 - CVE-2026-84268 published to the National Vulnerability Database (NVD)
• 2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-84268

Vulnerability Analysis

The flaw resides in the SFTP backend of gvfs, the userspace virtual filesystem layer used by the GNOME desktop. When the client issues an SSH_FXP_READ request, it allocates a buffer sized to the requested read length. The server responds with an SSH_FXP_DATA packet containing a length field followed by the file data.

The read_reply() handler parses this length field but does not compare it to the buffer size the client actually allocated. A malicious server can advertise a length larger than the request, causing subsequent copy operations to write past the end of the heap allocation. This corrupts adjacent heap metadata and objects inside gvfsd-sftp.

Exploitation requires the user to connect to an attacker-controlled SFTP server, which aligns with the user-interaction requirement in the vulnerability metadata. Once the corrupted allocator state is detected, glibc typically aborts the process, producing a denial of service. With careful heap grooming, an attacker can steer the overflow to hijack control flow and execute code as the invoking user.

Root Cause

The root cause is missing bounds validation of attacker-controlled protocol data. The SFTP client trusts the server-supplied length field in the reply and passes it to a memory copy without confirming it fits inside the client-allocated buffer. This is a classic heap buffer overflow pattern tracked as [CWE-122].

Attack Vector

The attack is network-based but requires the victim to initiate an SFTP mount to a malicious server, for example by opening an sftp:// Uniform Resource Identifier (URI) in Nautilus or another GNOME file manager. No credentials are required on the client side beyond what the user already provides to connect. Once the connection is established and the user reads a file, the malicious server returns a crafted SSH_FXP_DATA reply that triggers the overflow inside gvfsd-sftp.

No verified proof-of-concept code is available. See the GNOME gvfs Issue #862 and Red Hat Bug Report #2526485 for upstream technical discussion.

Detection Methods for CVE-2026-84268

Indicators of Compromise

• Unexpected crashes or SIGABRT termination of the gvfsd-sftp process, often with glibc messages such as malloc(): corrupted or free(): invalid pointer in the journal.
• Core dumps for gvfsd-sftp appearing in systemd-coredump logs shortly after an SFTP mount to an untrusted host.
• Outbound SSH or SFTP connections from desktop endpoints to unrecognized or newly registered hosts.

Detection Strategies

• Monitor journalctl and abrt logs for repeated gvfsd-sftp crashes correlated with user file-manager activity.
• Alert on child processes spawned by gvfsd-sftp outside its normal execution profile, which may indicate post-overflow code execution.
• Correlate SFTP mount events with connections to SSH endpoints that fall outside sanctioned infrastructure inventories.

Monitoring Recommendations

• Ingest desktop endpoint telemetry including process crashes, core dumps, and outbound SSH connections into a central data lake for retention and correlation.
• Track the gvfs package version across the Linux fleet to identify hosts still running vulnerable builds.
• Baseline normal SFTP destinations per user and flag first-seen or low-reputation SSH servers.

How to Mitigate CVE-2026-84268

Immediate Actions Required

• Apply vendor updates for gvfs as soon as fixed packages are available from your Linux distribution.
• Instruct users to avoid mounting SFTP shares from untrusted or unknown servers until patches are deployed.
• Restart user sessions or the gvfsd-sftp service after updating to ensure the patched binary is loaded.

Patch Information

Refer to the Red Hat CVE-2026-84268 Advisory for Red Hat Enterprise Linux errata and to the GNOME gvfs Issue #862 tracker for the upstream fix. Downstream distributions will backport the length-validation fix in read_reply() into their supported gvfs branches.

Workarounds

• Restrict outbound SSH and SFTP traffic from user endpoints to an allowlist of trusted servers at the network egress layer.
• Disable or remove the gvfs SFTP backend on systems that do not require SFTP integration, for example by uninstalling gvfs-backends subpackages that ship the SFTP module.
• Enforce user awareness policies that discourage opening sftp:// URIs received from untrusted sources.

# Check installed gvfs version and remove the SFTP backend where not needed
rpm -q gvfs gvfs-backends
sudo dnf remove gvfs-backends  # only if SFTP integration is not required

# Verify no gvfsd-sftp processes remain after removal or update
pgrep -a gvfsd-sftp