Red Hat Product Errata RHSA-2026:98513 - Security Advisory
Issued:
2026-11-11
Updated:
2026-11-11

RHSA-2026:98513 - Security Advisory

Synopsis

Important: gvfs security update

Type/Severity

Security Advisory: Important

Red Hat Lightspeed patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for gvfs is now available for Red Hat Enterprise Linux 9.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

GVFS is the GNOME Desktop Virtual File System layer that allows users to easily access local and remote data using File Transfer Protocol (FTP), Secure Shell File Transfer Protocol (SFTP), Web Distributed Authoring and Versioning (WebDAV), Common Internet File System (CIFS), Server Message Block (SMB), and other protocols. GVFS integrates with the GNOME I/O (GIO) abstraction layer.

Security Fix(es):

  • gvfs: SFTP: heap-based buffer overflow in read_reply() (CVE-2026-84268)
  • gvfs: gvfs-admin socket ownership race permits local root (CVE-2026-88924)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux for x86_64 9 x86_64
  • Red Hat Enterprise Linux for IBM z Systems 9 s390x
  • Red Hat Enterprise Linux for Power, little endian 9 ppc64le
  • Red Hat Enterprise Linux for ARM 64 9 aarch64
  • Red Hat CodeReady Linux Builder for x86_64 9 x86_64

Fixes

  • BZ - 2526485 - CVE-2026-84268 gvfs: SFTP: heap-based buffer overflow in read_reply()
  • BZ - 2531456 - CVE-2026-88924 gvfs: gvfs-admin socket ownership race permits local root

Red Hat Enterprise Linux for x86_64 9

SRPM
gvfs-1.48.1-9.el9_9.1.src.rpm SHA-256: 91764d78c28d2e2519bd708e2961ed0d38e3123e7f46e60f9b70ce6aef24438a
x86_64
gvfs-1.48.1-9.el9_9.1.x86_64.rpm SHA-256: 31b3d87e00d138357390cd8d2e7b2c23cc1ef26b0fe7309a1cc682aac2ec5fca
gvfs-client-1.48.1-9.el9_9.1.i686.rpm SHA-256: 6460b017e759ae41a7f8686499043a9d9d66702fa4496fc96e25409ffbea42f5
gvfs-client-1.48.1-9.el9_9.1.x86_64.rpm SHA-256: 944f4e0f57f05459e6ef0e14c2c44cd0cadeec03bf85d2c2a6da432a2cb79113
gvfs-client-debuginfo-1.48.1-9.el9_9.1.i686.rpm SHA-256: be92da0ed33911247228932cf0580428e86dc8b2c5ae7c8636e99677f07c79f0
gvfs-client-debuginfo-1.48.1-9.el9_9.1.x86_64.rpm SHA-256: 82b0bfcf1033e992c4a117d5302fd8b91e68bf118d0a37cceef53db8ea6a87a9
gvfs-debuginfo-1.48.1-9.el9_9.1.i686.rpm SHA-256: d3d710eca774dd25f3d18a7e25f1ebfaed871c07ea85dff4cb4c1b58a980fa0c
gvfs-debuginfo-1.48.1-9.el9_9.1.x86_64.rpm SHA-256: 52d6350e7b582239645010dd5189ebfa7985ce17da3be67d4d435e41a1b366f4
gvfs-debugsource-1.48.1-9.el9_9.1.i686.rpm SHA-256: 5371044f3ca330d246f7046d8c38eb7f28f20f47969e4d1a7102921056a9044b
gvfs-debugsource-1.48.1-9.el9_9.1.x86_64.rpm SHA-256: aad045311d0c86fa53eb7721852e4b04c478eae94957da3210beb26028badeb6
gvfs-devel-1.48.1-9.el9_9.1.i686.rpm SHA-256: 9a432d40bebb6d87d7b84a61785f593fe4aaee25c4d42e713575049a508f98b6
gvfs-devel-1.48.1-9.el9_9.1.x86_64.rpm SHA-256: 2cf330b154b0d83a6e2c1535bdb677070eaf873ba3f81b37677f542d669dd327
gvfs-fuse-1.48.1-9.el9_9.1.x86_64.rpm SHA-256: 299879766242e6c448b6414a0f4d5dff907d47c80a72b64ace5cd8c1c724cb64
gvfs-fuse-debuginfo-1.48.1-9.el9_9.1.i686.rpm SHA-256: 07c8fee33d91eaccd92e74d576c7c6f15810ab3d6d8e217869372f154318a572
gvfs-fuse-debuginfo-1.48.1-9.el9_9.1.x86_64.rpm SHA-256: 69a0ca3628e135d6b108d0a71645468a85033194842ed259296f34b372de7966
gvfs-goa-1.48.1-9.el9_9.1.x86_64.rpm SHA-256: 45d18d80f094210c987feb9b4e9bba2abad85adc05a43fd4c25ffb7161136784
gvfs-goa-debuginfo-1.48.1-9.el9_9.1.i686.rpm SHA-256: 16cbfc9c682323798e592b42b37017c01f036a5aaa13410c268e9e747ae819cc
gvfs-goa-debuginfo-1.48.1-9.el9_9.1.x86_64.rpm SHA-256: 6845e56a010a8893076cd5c7ea6c36fde8273391ec888ba99d20e102d029fe2b
gvfs-gphoto2-1.48.1-9.el9_9.1.x86_64.rpm SHA-256: 10bd439902a720dcf586f04ce71f1de147594131d002e1eea9e276b6ad1d58f0
gvfs-gphoto2-debuginfo-1.48.1-9.el9_9.1.i686.rpm SHA-256: 8fc9659f7124b14737ca1bac541b9ee34aa740506d1d2bb73d33bb44175d5b49
gvfs-gphoto2-debuginfo-1.48.1-9.el9_9.1.x86_64.rpm SHA-256: b63897cf54fa45594864e421935cfcc8e8fc52f897b883fcffe48ec66dfaa138
gvfs-mtp-1.48.1-9.el9_9.1.x86_64.rpm SHA-256: 1ad97a5e4d875512fe11427e74f16fc296b56b6bc59073ada1fbb40f46d94308
gvfs-mtp-debuginfo-1.48.1-9.el9_9.1.i686.rpm SHA-256: bb98cbd71b7f9ecdc0bf88071ae6484459e616188147cd9333ff36c0012e0e6a
gvfs-mtp-debuginfo-1.48.1-9.el9_9.1.x86_64.rpm SHA-256: eb992da9c29fa27789d4d8ec207e26c45300db3e8d88cd38c3beaef0031e9aeb
gvfs-smb-1.48.1-9.el9_9.1.x86_64.rpm SHA-256: 860d1ba146a9dd5834ccaf9d0990f1f5d1690956195744840baceb36eb37ac27
gvfs-smb-debuginfo-1.48.1-9.el9_9.1.i686.rpm SHA-256: 7a16f4efea6a1b63e09751e2f9ea0b8088eac16f6549bb97de3967f29d116810
gvfs-smb-debuginfo-1.48.1-9.el9_9.1.x86_64.rpm SHA-256: 2a2b3e3ec350676e2e29df05bb5e7eec5efc1bba480a5eea4d34fcc002753203

Red Hat Enterprise Linux for IBM z Systems 9

SRPM
gvfs-1.48.1-9.el9_9.1.src.rpm SHA-256: 91764d78c28d2e2519bd708e2961ed0d38e3123e7f46e60f9b70ce6aef24438a
s390x
gvfs-1.48.1-9.el9_9.1.s390x.rpm SHA-256: c2e736701c58f776bc6051b69bbcbd1fbc1a8979aeb0a7908420116e0ea34058
gvfs-client-1.48.1-9.el9_9.1.s390x.rpm SHA-256: 92bf470aed6822c0d452e9a047b428cf8857ad527b1f7acba540c428f4cf430b
gvfs-client-debuginfo-1.48.1-9.el9_9.1.s390x.rpm SHA-256: 07c1af0950b67bc6f0388d1747656e5ac3ce405e62a39a9ef4167b93934c8663
gvfs-debuginfo-1.48.1-9.el9_9.1.s390x.rpm SHA-256: add90737a58fc013a8fa8e3ff53d4a41fbe48029b5f0ac4d45e96a7e28ea9a63
gvfs-debugsource-1.48.1-9.el9_9.1.s390x.rpm SHA-256: 82b0a235234bf36701f1109f8f9c88f6833fda4dd032a584afcf5140b29a3556
gvfs-devel-1.48.1-9.el9_9.1.s390x.rpm SHA-256: 31eb3407e25c0bc2dae6a070dbf9377478e2b393f2274c4e471cd52b8ab5df30
gvfs-fuse-1.48.1-9.el9_9.1.s390x.rpm SHA-256: 382d91a05e0d9cd8b82415f2e21ddcb622864d8da17dd3b4263ff10a255f9a46
gvfs-fuse-debuginfo-1.48.1-9.el9_9.1.s390x.rpm SHA-256: 35bf9a4d5474fd7fce3cdead0188e5d7a12e013860e50c2934dede66859db562
gvfs-goa-1.48.1-9.el9_9.1.s390x.rpm SHA-256: ea587de9bc0488706cb034714f44ef978ae056734c96719c04aa5314b104b871
gvfs-goa-debuginfo-1.48.1-9.el9_9.1.s390x.rpm SHA-256: 6eb5582bc3ba85c32fb2d89d49c059f768da1e72a99529a28049b3ae34eaac95
gvfs-gphoto2-1.48.1-9.el9_9.1.s390x.rpm SHA-256: 765b5f2362e1e1bbe961707e0a67a4b27baf4194c4170aed31661a7098e0d752
gvfs-gphoto2-debuginfo-1.48.1-9.el9_9.1.s390x.rpm SHA-256: 426fab6ddfd4750b879118e1be67bcabd5780e1cec30541f77889fbac443b19b
gvfs-mtp-1.48.1-9.el9_9.1.s390x.rpm SHA-256: 4944b07e25b772ff825d8d1d885ab3b99f0b79600cb2f95e2137e6302b30a069
gvfs-mtp-debuginfo-1.48.1-9.el9_9.1.s390x.rpm SHA-256: 3d1221258392c2decdeb09cebd441a1a21702ce7ec469e8b53a3aeebf7cd5657
gvfs-smb-1.48.1-9.el9_9.1.s390x.rpm SHA-256: 0d9780a21ef28bce48fa19436586d1b2d1c2515ef801b6da5d9c390a75a539a3
gvfs-smb-debuginfo-1.48.1-9.el9_9.1.s390x.rpm SHA-256: 867aec229f3d88d963800571a5b543533c0624174f4f08b5057797b7c62d4ae4

Red Hat Enterprise Linux for Power, little endian 9

SRPM
gvfs-1.48.1-9.el9_9.1.src.rpm SHA-256: 91764d78c28d2e2519bd708e2961ed0d38e3123e7f46e60f9b70ce6aef24438a
ppc64le
gvfs-1.48.1-9.el9_9.1.ppc64le.rpm SHA-256: 7507e9ccda73cb7747308db32e0580f2e46cbf5346dd220f995d05286d8cebf5
gvfs-client-1.48.1-9.el9_9.1.ppc64le.rpm SHA-256: e4de1ed45538c2ac35c6a2a3b8a4a19b50f2627140d3d02f92aadebd3b7e76c3
gvfs-client-debuginfo-1.48.1-9.el9_9.1.ppc64le.rpm SHA-256: c329db384f7e63c7124ea4c9791592a5d44d19501b9ee7aa6cbe2c358ab4dffb
gvfs-debuginfo-1.48.1-9.el9_9.1.ppc64le.rpm SHA-256: 8a10cf524af8c58220c3dd945775f8b43d281caba299d1dcf869afa086248ec2
gvfs-debugsource-1.48.1-9.el9_9.1.ppc64le.rpm SHA-256: 428f54077a5f6c41ef4ca987e596bacd063415cfabc2d49f76ef580b539d7d36
gvfs-devel-1.48.1-9.el9_9.1.ppc64le.rpm SHA-256: cf064b245f35dc18f3f85f6b48d66f96669da3436ae4c73644dbdbaeba2f47b2
gvfs-fuse-1.48.1-9.el9_9.1.ppc64le.rpm SHA-256: e2e62a3ba112e1fef19761fb01d310826186636cc4292ef51a1f01bd1d306f83
gvfs-fuse-debuginfo-1.48.1-9.el9_9.1.ppc64le.rpm SHA-256: 51641bc71f4137616f19341a902bccba7b5682757f01bf2afe87df815f4ae6c0
gvfs-goa-1.48.1-9.el9_9.1.ppc64le.rpm SHA-256: b12f99c0a2799b241657184a04f8b8a91c6bdbfd11f7a00ef49bb2140259d52a
gvfs-goa-debuginfo-1.48.1-9.el9_9.1.ppc64le.rpm SHA-256: 4700a01b17e0d3afce8ed50a2f0f6bb04e19fafdb8fcc68ae5a2df2e3d5b9ce3
gvfs-gphoto2-1.48.1-9.el9_9.1.ppc64le.rpm SHA-256: 164300fa70c67062d00a2c1b235479ea6bae89d5abc104dd59d08799a96e5954
gvfs-gphoto2-debuginfo-1.48.1-9.el9_9.1.ppc64le.rpm SHA-256: bb9b9eea54fa1a8d81da77baf579ba0d1e158efe9cfec3bebf625fc0c24fa42e
gvfs-mtp-1.48.1-9.el9_9.1.ppc64le.rpm SHA-256: 7afb69e59bd9d2244ab3b1999204e601602eed8fe72d6d8d1c9d6271d907dfec
gvfs-mtp-debuginfo-1.48.1-9.el9_9.1.ppc64le.rpm SHA-256: 484a430c3df940a7b31f5a1149a2ed3fc65a622ece8db753cc67a3542059b1f5
gvfs-smb-1.48.1-9.el9_9.1.ppc64le.rpm SHA-256: 69c418693b6d539a700221b9fc7994be367a43debc581e1b0657b1e29e615152
gvfs-smb-debuginfo-1.48.1-9.el9_9.1.ppc64le.rpm SHA-256: 4e9b20546ed97ab899cc7bf31b6ac89ae51be30aa1af081b84b7df6e7646b1f2

Red Hat Enterprise Linux for ARM 64 9

SRPM
gvfs-1.48.1-9.el9_9.1.src.rpm SHA-256: 91764d78c28d2e2519bd708e2961ed0d38e3123e7f46e60f9b70ce6aef24438a
aarch64
gvfs-1.48.1-9.el9_9.1.aarch64.rpm SHA-256: ff7a2d1742259586223384aa7f3e9ddf9577cb39b4ac8168143ec1e3c503d999
gvfs-client-1.48.1-9.el9_9.1.aarch64.rpm SHA-256: 141f9952de02cc1775eedc80ae618cb571022c3f5d662c98d16651adf35e82a4
gvfs-client-debuginfo-1.48.1-9.el9_9.1.aarch64.rpm SHA-256: ff7bf1d40c3fc64b62dfdcd470c529b8aac4c1b5389605d07463822b635c2f35
gvfs-debuginfo-1.48.1-9.el9_9.1.aarch64.rpm SHA-256: 1f8699ca7d87dd1e05243a0e9600c7aa827001467ade0565434ead2d9a22d5ba
gvfs-debugsource-1.48.1-9.el9_9.1.aarch64.rpm SHA-256: 5cd89aa8222ce1cd1664d90f33c2f31ac4f0cf22d51eb6d47c975208484c317b
gvfs-devel-1.48.1-9.el9_9.1.aarch64.rpm SHA-256: 6452dbf8d7e09503d1658d575c35aa2a536c6fa398db23b52a81d0edf6f419f6
gvfs-fuse-1.48.1-9.el9_9.1.aarch64.rpm SHA-256: 6cb09c34de8bce6de19a4590a775368d18fe19834d8fa64b704627dfe43d68d5
gvfs-fuse-debuginfo-1.48.1-9.el9_9.1.aarch64.rpm SHA-256: 0cfaaa5b74a1276e4b8873258288c33e6e6a4260c5ff76d574bd826ce0d81897
gvfs-goa-1.48.1-9.el9_9.1.aarch64.rpm SHA-256: 20979da8c8e41cfd2d2764f24a75776e2d6aa9852939076282e6c63e8471bd14
gvfs-goa-debuginfo-1.48.1-9.el9_9.1.aarch64.rpm SHA-256: 2e82048d4085f0e5476207760ca37739be2be708779fef761f2067d1667699e8
gvfs-gphoto2-1.48.1-9.el9_9.1.aarch64.rpm SHA-256: 834a94ad2592a806985141759210fc964ff62d2b94e879b0dac2982581f5f19f
gvfs-gphoto2-debuginfo-1.48.1-9.el9_9.1.aarch64.rpm SHA-256: 152deb1edcda29dbf1e2ab7cc6451a1a416713e36c1b9abb5031902e293f3682
gvfs-mtp-1.48.1-9.el9_9.1.aarch64.rpm SHA-256: 31ea551ab1b3463c703ddee7bd7f085eb4d96b2c9494436759ff6ebf2ec9b254
gvfs-mtp-debuginfo-1.48.1-9.el9_9.1.aarch64.rpm SHA-256: 20e8a8cee1433fbfba3e6f048504188d7f075e290fdcfd99cda322f71590522d
gvfs-smb-1.48.1-9.el9_9.1.aarch64.rpm SHA-256: a638d079a88a3169b90d5628d6465c78e2e810161c71f3787c1a90d40c8a865d
gvfs-smb-debuginfo-1.48.1-9.el9_9.1.aarch64.rpm SHA-256: 50441949582f8292e4d4957cc4692d3849c46379855870c00d382ec51cf35df5

Red Hat CodeReady Linux Builder for x86_64 9

SRPM
x86_64
gvfs-1.48.1-9.el9_9.1.i686.rpm SHA-256: 1ce27c39f37ac5ddea29205429123659bdae19b04ab573212a73f0abf6b381a3
gvfs-client-debuginfo-1.48.1-9.el9_9.1.i686.rpm SHA-256: be92da0ed33911247228932cf0580428e86dc8b2c5ae7c8636e99677f07c79f0
gvfs-debuginfo-1.48.1-9.el9_9.1.i686.rpm SHA-256: d3d710eca774dd25f3d18a7e25f1ebfaed871c07ea85dff4cb4c1b58a980fa0c
gvfs-debugsource-1.48.1-9.el9_9.1.i686.rpm SHA-256: 5371044f3ca330d246f7046d8c38eb7f28f20f47969e4d1a7102921056a9044b
gvfs-fuse-debuginfo-1.48.1-9.el9_9.1.i686.rpm SHA-256: 07c8fee33d91eaccd92e74d576c7c6f15810ab3d6d8e217869372f154318a572
gvfs-goa-debuginfo-1.48.1-9.el9_9.1.i686.rpm SHA-256: 16cbfc9c682323798e592b42b37017c01f036a5aaa13410c268e9e747ae819cc
gvfs-gphoto2-debuginfo-1.48.1-9.el9_9.1.i686.rpm SHA-256: 8fc9659f7124b14737ca1bac541b9ee34aa740506d1d2bb73d33bb44175d5b49
gvfs-mtp-debuginfo-1.48.1-9.el9_9.1.i686.rpm SHA-256: bb98cbd71b7f9ecdc0bf88071ae6484459e616188147cd9333ff36c0012e0e6a
gvfs-smb-debuginfo-1.48.1-9.el9_9.1.i686.rpm SHA-256: 7a16f4efea6a1b63e09751e2f9ea0b8088eac16f6549bb97de3967f29d116810

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.