CVE-2026-84269: gvfs AFP Backend DoS Vulnerability

CVE-2026-84269 Overview

CVE-2026-84269 is a heap buffer overflow [CWE-122] in the Apple Filing Protocol (AFP) backend of GNOME Virtual File System (gvfs). The flaw resides in the Data Stream Interface (DSI) read path used when mounting an AFP share. A malicious AFP server can return a length value that exceeds the pre-sized reply buffer allocated by the client. The gvfsd-afp process does not validate the server-provided length before accessing the buffer, allowing memory access beyond the intended boundary. Successful exploitation crashes the gvfsd-afp process, causing a denial of service on the client system.

Critical Impact
A remote malicious AFP server can crash the gvfsd-afp process on a client that mounts a share, resulting in denial of service.

Affected Products

GNOME gvfs — AFP backend (gvfsd-afp)
Red Hat Enterprise Linux distributions shipping affected gvfs versions
Linux desktop environments using gvfs for AFP share mounting

Discovery Timeline

2026-09-01 - CVE-2026-84269 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-84269

Vulnerability Analysis

The vulnerability exists in the DSI protocol handling code within the AFP backend of gvfs. DSI is the transport layer used to carry AFP requests and responses between the client and server over TCP. When the client issues a read request, it allocates a reply buffer sized to the requested length. The server response includes its own length field indicating how much data follows.

The AFP backend trusts the server-supplied length without comparing it against the size of the pre-allocated reply buffer. When a malicious server returns a length larger than the client requested, the read path writes past the end of the heap-allocated buffer. This heap overflow corrupts adjacent heap metadata and terminates the gvfsd-afp process.

The attack requires user interaction because a user must initiate the mount operation against the attacker-controlled server. Confidentiality and integrity are not directly impacted, but availability of the file system service is lost.

Root Cause

The root cause is missing input validation on the server-provided length field in the DSI read reply. The function performs no bounds check comparing the incoming length against the client's request size or the allocated buffer capacity before copying data.

Attack Vector

An attacker operates a malicious AFP server on the network. When a victim mounts an AFP share hosted by this server through gvfs, the server returns crafted DSI read responses containing oversized length fields. The client processes the reply, overflows the heap buffer, and the gvfsd-afp process crashes. Repeated exploitation prevents the user from accessing AFP-mounted resources.

No verified public proof-of-concept code is available. See the GNOME gvfs Issue #863 and Red Hat CVE-2026-84269 Advisory for technical details.

Detection Methods for CVE-2026-84269

Indicators of Compromise

Unexpected crashes or core dumps of the gvfsd-afp process in system logs or journalctl output.
Outbound TCP connections from user desktops to untrusted hosts on AFP port 548.
Repeated mount failures against AFP shares immediately followed by process termination messages.

Detection Strategies

Monitor process crash telemetry for gvfsd-afp terminations correlated with recent AFP mount operations.
Inspect network traffic for AFP/DSI sessions where reply length fields exceed the corresponding client request size.
Alert on SIGSEGV or SIGABRT events targeting gvfs daemons in systemd-coredump records.

Monitoring Recommendations

Enable core dump collection for gvfs backend processes and forward to centralized logging.
Track user-initiated AFP mount events against external or untrusted network destinations.
Correlate desktop crash reports with concurrent DNS or TCP activity toward unfamiliar AFP servers.

How to Mitigate CVE-2026-84269

Immediate Actions Required

Apply distribution updates for gvfs once vendors publish patched packages per the Red Hat CVE-2026-84269 Advisory.
Restrict outbound TCP port 548 (AFP) at network egress points to trusted file server destinations only.
Instruct users to avoid mounting AFP shares from untrusted or unknown servers.

Patch Information

Refer to the Red Hat Bug Report #2526784 and upstream GNOME gvfs Issue #863 for patch status and fixed package versions. Apply vendor-supplied updates for the gvfs and gvfs-afp packages as they become available.

Workarounds

Uninstall or disable the AFP backend package (gvfs-afp on Red Hat-based distributions) where AFP support is not required.
Block outbound connections to TCP port 548 using host or network firewall rules until patches are deployed.
Prefer SMB or NFS for cross-platform file sharing where AFP is not a functional requirement.

bash

# Remove the AFP backend on Red Hat-based systems
sudo dnf remove gvfs-afp

# Or block outbound AFP traffic with firewalld
sudo firewall-cmd --permanent --direct --add-rule ipv4 filter OUTPUT 0 -p tcp --dport 548 -j REJECT
sudo firewall-cmd --reload