CVE-2026-84270: gvfs MTP Backend DOS Vulnerability

CVE-2026-84270 Overview

A flaw was found in the Media Transfer Protocol (MTP) backend of GNOME Virtual File System (gvfs). The do_read() function in gvfsbackendmtp.c trusts the data length returned by a connected MTP device without bounding it against the client's requested size. A malicious MTP device can return more bytes than requested, and the unchecked length is passed directly to memcpy(). This results in an out-of-bounds read [CWE-125] that can crash the gvfsd-mtp process. Exploitation requires physical access to plug in a hostile MTP device, and the impact is a denial of service against the file system service.

Critical Impact
A malicious MTP device connected to a target system triggers a segmentation fault in gvfsd-mtp, denying access to virtual file system services until the process is restarted.

Affected Products

GNOME gvfs — MTP backend (gvfsbackendmtp.c)
Linux distributions shipping vulnerable gvfs builds (Red Hat advisory tracked)
Desktop environments relying on gvfs for MTP device mounting

Discovery Timeline

2026-09-01 - CVE-2026-84270 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-84270

Vulnerability Analysis

The defect resides in the MTP backend that gvfs uses to expose portable media devices as mounted file systems. When a client application reads from a file on a mounted MTP device, do_read() in gvfsbackendmtp.c issues a read request and receives a buffer with a device-reported length. The code does not clamp this returned length to the original size the client requested. It passes the untrusted length straight into memcpy(), which copies data into a fixed-size destination buffer.

A malicious MTP device returns a length that exceeds the caller's requested size. The memcpy() then reads past the end of the source buffer allocated by the backend. The out-of-bounds read produces a segmentation fault and terminates the gvfsd-mtp daemon. The result is a denial of service on the virtual file system integration for MTP devices.

Root Cause

The root cause is missing input validation on data returned by an external device. The backend implicitly trusts a length field controlled by the MTP peer. Secure handling requires bounding the copy length to the minimum of the requested size and the buffer capacity before calling memcpy().

Attack Vector

An attacker must physically attach a crafted MTP device to the target system, such as a rogue phone, camera, or MTP-emulating USB peripheral. User interaction is required because a file on the mounted device must be read. The attack yields no code execution, information disclosure, or integrity impact — only a crash of gvfsd-mtp.

No verified public exploit code is available. The vulnerability mechanism is described in the referenced advisories, including the GNOME gvfs Issue #864 and the Red Hat Bug Report #2526794.

Detection Methods for CVE-2026-84270

Indicators of Compromise

Repeated segmentation faults or crashes of the gvfsd-mtp process recorded in system journals.
systemd-coredump or abrt entries citing gvfsd-mtp following MTP device connection events.
USB or udev events showing MTP device enumeration immediately preceding gvfs service failure.

Detection Strategies

Monitor journalctl and dmesg for gvfsd-mtp SIGSEGV events correlated with USB attach events.
Alert on core dumps generated from gvfs binaries on endpoints that do not routinely handle MTP peripherals.
Track user sessions where MTP mounts fail immediately after device insertion, which may indicate malformed device responses.

Monitoring Recommendations

Enable USB device auditing through auditd or endpoint telemetry to record vendor and product identifiers of attached MTP devices.
Forward Linux endpoint logs, udev events, and coredump metadata to a centralized analytics platform for correlation.
Baseline expected MTP device usage per host and flag unexpected physical device connections in sensitive environments.

How to Mitigate CVE-2026-84270

Immediate Actions Required

Apply vendor-provided gvfs updates as soon as they are available from your Linux distribution.
Restrict physical access to endpoints in high-value environments to prevent connection of untrusted MTP devices.
Disable or mask the gvfsd-mtp service on systems that do not require MTP support.

Patch Information

Refer to the Red Hat CVE-2026-84270 Advisory for package versions and errata. Upstream fix status is tracked in GNOME gvfs Issue #864. The fix bounds the memcpy() length in do_read() to the size originally requested by the caller.

Workarounds

Uninstall or disable the gvfs MTP backend package on systems that never connect phones, cameras, or other MTP devices.
Enforce USB device control policies that block MTP-class devices except from an approved allowlist.
Configure endpoint policy to prevent automatic mounting of removable media in shared or kiosk environments.

bash

# Disable the gvfs MTP backend service for the current user session
systemctl --user mask gvfs-mtp-volume-monitor.service
systemctl --user stop gvfs-mtp-volume-monitor.service

# Optional: remove the MTP backend package (Fedora/RHEL example)
sudo dnf remove gvfs-mtp