ALSA-2026:74370

See a problem?
Import Source
https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux9/ALSA-2026:74370.json
JSON Data
https://api.test.osv.dev/v1/vulns/ALSA-2026:74370
Related
CVE (2)
Published
2026-10-01T00:00:00Z
Modified
2026-10-01T14:45:02Z
Summary
Important: gvfs security update
Details

GVFS is the GNOME Desktop Virtual File System layer that allows users to easily access local and remote data using File Transfer Protocol (FTP), Secure Shell File Transfer Protocol (SFTP), Web Distributed Authoring and Versioning (WebDAV), Common Internet File System (CIFS), Server Message Block (SMB), and other protocols. GVFS integrates with the GNOME I/O (GIO) abstraction layer.

Security Fix(es):

  • gvfs: SFTP: heap-based buffer overflow in read_reply() (CVE-2026-84268)
  • gvfs: gvfs-admin socket ownership race permits local root (CVE-2026-88924)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References

Affected packages

AlmaLinux:9
gvfs

Package

Name
gvfs
Purl
pkg:rpm/almalinux/gvfs

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.48.1-8.el9_8.1

Database specific

source 
"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux9/ALSA-2026:74370.json"
gvfs-client

Package

Name
gvfs-client
Purl
pkg:rpm/almalinux/gvfs-client

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.48.1-8.el9_8.1

Database specific

source 
"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux9/ALSA-2026:74370.json"
gvfs-devel

Package

Name
gvfs-devel
Purl
pkg:rpm/almalinux/gvfs-devel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.48.1-8.el9_8.1

Database specific

source 
"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux9/ALSA-2026:74370.json"
gvfs-fuse

Package

Name
gvfs-fuse
Purl
pkg:rpm/almalinux/gvfs-fuse

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.48.1-8.el9_8.1

Database specific

source 
"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux9/ALSA-2026:74370.json"
gvfs-goa

Package

Name
gvfs-goa
Purl
pkg:rpm/almalinux/gvfs-goa

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.48.1-8.el9_8.1

Database specific

source 
"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux9/ALSA-2026:74370.json"
gvfs-gphoto2

Package

Name
gvfs-gphoto2
Purl
pkg:rpm/almalinux/gvfs-gphoto2

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.48.1-8.el9_8.1

Database specific

source 
"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux9/ALSA-2026:74370.json"
gvfs-mtp

Package

Name
gvfs-mtp
Purl
pkg:rpm/almalinux/gvfs-mtp

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.48.1-8.el9_8.1

Database specific

source 
"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux9/ALSA-2026:74370.json"
gvfs-smb

Package

Name
gvfs-smb
Purl
pkg:rpm/almalinux/gvfs-smb

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.48.1-8.el9_8.1

Database specific

source 
"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux9/ALSA-2026:74370.json"