Ubuntu USN-8845-1 Fixes GVfs Vulnerabilities
Tech GuruQuick Answer
USN-8845-1 fixes two GVfs flaws: unsafe handling of SFTP-server data and a local file-ownership error in the admin backend. The local privilege-escalation issue affects only Ubuntu 22.04, 24.04 and 26.04; the SFTP issue has the wider release scope shown below. Update the installed GVfs binaries, save open work and restart the user session as Canonical requires.
Confirm Scope And Apply The Supported Fix
What to do now: Prioritize desktops and user sessions that access remote files through GVfs, then map installed gvfs-backends and gvfs-libs to the release-specific versions below. Arrange a session restart with the user; closing one file-manager window is not the restart Canonical specifies.
Last verified: 2026-10-02 UTC against USN-8845-1 JSON. No desktop, session restart or file operation was tested.
Scope And Authority
| Product scope | GVfs vulnerabilities on Ubuntu 26.04 LTS (resolute), Ubuntu 24.04 LTS (noble), Ubuntu 22.04 LTS (jammy), Ubuntu 20.04 ESM (focal), Ubuntu 18.04 ESM (bionic), Ubuntu 16.04 ESM (xenial) |
|---|---|
| Advisory | USN-8845-1 |
| CVEs | CVE-2026-84268, CVE-2026-88924 |
| Authoritative release date | 2026-09-30 15:54:56.826327 UTC |
| Authority revision date | No separate material revision date is stated by Ubuntu; verified against the first-party notice API. |
| Affected versions | The Ubuntu releases and source packages enumerated in USN-8845-1: Ubuntu 26.04 LTS (resolute), Ubuntu 24.04 LTS (noble), Ubuntu 22.04 LTS (jammy), Ubuntu 20.04 ESM (focal), Ubuntu 18.04 ESM (bionic), Ubuntu 16.04 ESM (xenial). |
| Fixed version | Selected runtime binaries; update those installed and their required dependencies. The linked USN has the full package list: bionic: gvfs-backends 1.36.1-0ubuntu1.3.3+esm1 (esm-infra)bionic: gvfs-libs 1.36.1-0ubuntu1.3.3+esm1 (esm-infra)focal: gvfs-backends 1.44.1-1ubuntu1.2+esm1 (esm-infra)focal: gvfs-libs 1.44.1-1ubuntu1.2+esm1 (esm-infra)jammy: gvfs-backends 1.48.2-0ubuntu1.2 (security)jammy: gvfs-libs 1.48.2-0ubuntu1.2 (security)noble: gvfs-backends 1.54.4-0ubuntu1~24.04.4 (security)noble: gvfs-libs 1.54.4-0ubuntu1~24.04.4 (security)resolute: gvfs-backends 1.60.0-1ubuntu0.1 (security)resolute: gvfs-libs 1.60.0-1ubuntu0.1 (security)xenial: gvfs-backends 1.28.2-1ubuntu1~16.04.3+esm1 (esm-infra-legacy)xenial: gvfs-libs 1.28.2-1ubuntu1~16.04.3+esm1 (esm-infra-legacy) |
| CVSS base score | Not provided by the authority |
| CVSS severity | Not provided by the authority |
| Exploitation status | Not stated by the authority; no exploitation claim is inferred. |
What Changed
CVE-2026-84268 concerns data received from SFTP servers and can lead to a heap buffer overflow, code execution or denial of service. CVE-2026-88924 concerns ownership handling while the admin backend creates private D-Bus sockets; a local attacker may change ownership of system files and gain root privileges. Do not extend the latter claim to the older Ubuntu releases that Canonical excludes.
What To Validate Now
- Identify affected sessions. Record Ubuntu release and installed GVfs binaries. Distinguish ordinary remote-file access from admin-backend use and note the narrower release scope of CVE-2026-88924.
- Protect open work. Ask users to save documents and finish remote transfers before the session restart. Retain a supported way back into the desktop; do not terminate sessions blindly during an unattended package job.
- Update the installed binaries. Use the matching supported repository and versions above. Ubuntu 18.04/20.04 use ESM Infra; 16.04 uses its Legacy Support channel. The 22.04/24.04/26.04 builds are in the security pocket.
- Restart and test normal access. Restart the user session, then verify package versions and a benign file operation against an authorized SFTP server. Where admin-backend access is required, verify authorized access and expected denials without changing arbitrary system-file ownership.
- Retain useful evidence. Record package origin, version, session restart and results. Redact remote usernames, paths and credentials; investigate crashes or unexpected authorization before wider rollout.
Operational Cautions
Do not weaken file permissions or grant broad administrative access to mask a post-update failure. A working SFTP connection does not test the separate local privilege boundary. These are proposed checks, not observed results, and the notice does not state exploitation.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
