Red Hat Product Errata RHSA-2026:98623 - Security Advisory
Issued:
2026-11-11
Updated:
2026-11-11

RHSA-2026:98623 - Security Advisory

Synopsis

Important: gvfs security update

Type/Severity

Security Advisory: Important

Red Hat Lightspeed patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for gvfs is now available for Red Hat Enterprise Linux 10.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

GVFS is the GNOME Desktop Virtual File System layer that allows users to easily access local and remote data using File Transfer Protocol (FTP), Secure Shell File Transfer Protocol (SFTP), Web Distributed Authoring and Versioning (WebDAV), Common Internet File System (CIFS), Server Message Block (SMB), and other protocols. GVFS integrates with the GNOME I/O (GIO) abstraction layer.

Security Fix(es):

  • gvfs: SFTP: heap-based buffer overflow in read_reply() (CVE-2026-84268)
  • gvfs: gvfs-admin socket ownership race permits local root (CVE-2026-88924)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux for x86_64 10 x86_64
  • Red Hat Enterprise Linux for IBM z Systems 10 s390x
  • Red Hat Enterprise Linux for Power, little endian 10 ppc64le
  • Red Hat Enterprise Linux for ARM 64 10 aarch64

Fixes

  • BZ - 2526485 - CVE-2026-84268 gvfs: SFTP: heap-based buffer overflow in read_reply()
  • BZ - 2531456 - CVE-2026-88924 gvfs: gvfs-admin socket ownership race permits local root

Red Hat Enterprise Linux for x86_64 10

SRPM
gvfs-1.54.4-5.el10_3.1.src.rpm SHA-256: e2353d8386649bb73fe0f118c3464af82fc8d5da41c972c172cccd0bab53e1cd
x86_64
gvfs-1.54.4-5.el10_3.1.x86_64.rpm SHA-256: d16a479c69967113d1710be7816c2f7494575c11ac4a7b44cbb5de5b328d8082
gvfs-client-1.54.4-5.el10_3.1.x86_64.rpm SHA-256: c381bebfebb17aa51ae9d01acc4969da9543523f1418ea9443cca06498c4956c
gvfs-client-debuginfo-1.54.4-5.el10_3.1.x86_64.rpm SHA-256: 199e07eb89edf165d55c58c55325d20b1dbc9483132966cdf26096aa9c7f264d
gvfs-debuginfo-1.54.4-5.el10_3.1.x86_64.rpm SHA-256: 201a905cf137fb8688c3070d734b12ec2b01708a27039b92b7b4ba90710be65d
gvfs-debugsource-1.54.4-5.el10_3.1.x86_64.rpm SHA-256: ac9655e51e4636e88cbf4b1df17db454d1e32b9df16ff470cb8b3901d21668a1
gvfs-fuse-1.54.4-5.el10_3.1.x86_64.rpm SHA-256: f8eddaf922ba2775ad9a63e78591887f5c3f28ed8da80486afdd10ab645ec2bf
gvfs-fuse-debuginfo-1.54.4-5.el10_3.1.x86_64.rpm SHA-256: 11bbe24059bbad7f58bdaff5c6503c1c3826a316167adb77383bdf0cd605dbaf
gvfs-goa-1.54.4-5.el10_3.1.x86_64.rpm SHA-256: 773556c4dd3075ed1ce0a088acf7065aabd02e0fc20423115bf191a72cde0ac2
gvfs-goa-debuginfo-1.54.4-5.el10_3.1.x86_64.rpm SHA-256: c93825d6eed12ea84ba5990d631a8fca5ac11ff1717a36c1679a82d14b0bbd47
gvfs-gphoto2-1.54.4-5.el10_3.1.x86_64.rpm SHA-256: cf35ac574559dbee86066013050c3017caf1f71e841fee076efdbc9104abce83
gvfs-gphoto2-debuginfo-1.54.4-5.el10_3.1.x86_64.rpm SHA-256: e737fd777c79b3c55bcf51eea90915d42542f6b83579c2cb6407caef37843401
gvfs-mtp-1.54.4-5.el10_3.1.x86_64.rpm SHA-256: b2219327a3155514eb40c8b870cefe891f45c173a259ba811944ac664be91645
gvfs-mtp-debuginfo-1.54.4-5.el10_3.1.x86_64.rpm SHA-256: 269ab42293d520c5184bd655a5c6de54099b1363b12ad55cdc4fd118f8455da0
gvfs-smb-1.54.4-5.el10_3.1.x86_64.rpm SHA-256: 5cca4227ea0040f663f3895ae4e0260ae0165ed1cc0b338f16380c20865dccc1
gvfs-smb-debuginfo-1.54.4-5.el10_3.1.x86_64.rpm SHA-256: 122ce4a6a577ee69e60a4ca5926c59c894d09f7ecebc7edf98796483a0353e63

Red Hat Enterprise Linux for IBM z Systems 10

SRPM
gvfs-1.54.4-5.el10_3.1.src.rpm SHA-256: e2353d8386649bb73fe0f118c3464af82fc8d5da41c972c172cccd0bab53e1cd
s390x
gvfs-1.54.4-5.el10_3.1.s390x.rpm SHA-256: 4ea483ec3daa5d041d72664c8e0d13156533514246ad49ec202f9acea90c7663
gvfs-client-1.54.4-5.el10_3.1.s390x.rpm SHA-256: 8fa1031b3c9b7790dc76ecd618cd1183b11b9ff3b6f62f907733dd460ecdb14b
gvfs-client-debuginfo-1.54.4-5.el10_3.1.s390x.rpm SHA-256: 8f2337432baf72514011c2609e82010205dcaf3e8207454e95e3572d09bd7f4c
gvfs-debuginfo-1.54.4-5.el10_3.1.s390x.rpm SHA-256: 195f387d634ec196921ea5206d9aae1dfbd7c62eb6669a6717d46d2abae8258c
gvfs-debugsource-1.54.4-5.el10_3.1.s390x.rpm SHA-256: 06df97fcdac52cb613e943e0c2afee8a98ddacdcd68bf97760ffab18a287e72e
gvfs-fuse-1.54.4-5.el10_3.1.s390x.rpm SHA-256: a28ea9a258126a1efb85571ebc409ee131345531ae97b8c6a7d1e90ddcd66de7
gvfs-fuse-debuginfo-1.54.4-5.el10_3.1.s390x.rpm SHA-256: a50ae0bec027885e3fc6ce50ba13b89a41b3cb28ca75b85c10f6eb50b37732c5
gvfs-goa-1.54.4-5.el10_3.1.s390x.rpm SHA-256: 58874215ddf233bc31c02f9ecf3cec3618ad77090a9e8c1ab59e54eacf828bbb
gvfs-goa-debuginfo-1.54.4-5.el10_3.1.s390x.rpm SHA-256: e2fb2d41485b811dc59e31d0e3576e8578f817af7b3d16011d81a2a8ec4bf352
gvfs-smb-1.54.4-5.el10_3.1.s390x.rpm SHA-256: 88b06c4c053e1890efe3530754b818da86154f19af111309eb8bf8457ff0612f
gvfs-smb-debuginfo-1.54.4-5.el10_3.1.s390x.rpm SHA-256: 77d561d7c6bb977e37d272cd908a4a26b0ec973e07940b79898d13a81cd2d882

Red Hat Enterprise Linux for Power, little endian 10

SRPM
gvfs-1.54.4-5.el10_3.1.src.rpm SHA-256: e2353d8386649bb73fe0f118c3464af82fc8d5da41c972c172cccd0bab53e1cd
ppc64le
gvfs-1.54.4-5.el10_3.1.ppc64le.rpm SHA-256: af1ce49489036fad6acf0a8d3f847dd452759aa8c89c4595f74ea1b3b2ca8d42
gvfs-client-1.54.4-5.el10_3.1.ppc64le.rpm SHA-256: 369d387b4aa66ee682444c2989ceb9c5406aece07a04eb07fedd36556a21e556
gvfs-client-debuginfo-1.54.4-5.el10_3.1.ppc64le.rpm SHA-256: a5e97dc0e81b7986c25d08d5d7705c9eada50673c8a5977c0f246900d8cb5170
gvfs-debuginfo-1.54.4-5.el10_3.1.ppc64le.rpm SHA-256: e671c428fef220bfd9ce1570ad943eaaed6b436b5357f3c1dbce573b325bb119
gvfs-debugsource-1.54.4-5.el10_3.1.ppc64le.rpm SHA-256: 6ba3b22102593e77a2c743dde51c824c95e69a83388a88bf30e793cb73879682
gvfs-fuse-1.54.4-5.el10_3.1.ppc64le.rpm SHA-256: cd83baabc06d4bd5fb2f4122b8602d529ed46305130796bd7daae9846ddb1bc3
gvfs-fuse-debuginfo-1.54.4-5.el10_3.1.ppc64le.rpm SHA-256: abf991a5ccf739cd09a0daa14c9dd68b362434e866f783e5fc73d10736e74c05
gvfs-goa-1.54.4-5.el10_3.1.ppc64le.rpm SHA-256: 42e0f202960673fa2411bcdecf19fe21f89b32d8cf358220a514ce308856cfd1
gvfs-goa-debuginfo-1.54.4-5.el10_3.1.ppc64le.rpm SHA-256: 5b894669e62a062c975ddf99837f8a5c760840852bde4503af8123c4709ac686
gvfs-gphoto2-1.54.4-5.el10_3.1.ppc64le.rpm SHA-256: ab5c147f0291ff44b18d0fde3fd2dd40835d89bd683f74103354a9265a13711a
gvfs-gphoto2-debuginfo-1.54.4-5.el10_3.1.ppc64le.rpm SHA-256: d05c079f9119b40fdb73aae9f5fb0cde3d1ec6f29b7214c4d7d63aae28745843
gvfs-mtp-1.54.4-5.el10_3.1.ppc64le.rpm SHA-256: c4fef32368340974d84b85033d27667bbfa16ed1096df8ebc82eeae73d1841a3
gvfs-mtp-debuginfo-1.54.4-5.el10_3.1.ppc64le.rpm SHA-256: 6cdb9a6f0230af3c0de42698d9b4f0a0df6661046fc0415a9a836f09d5e69f85
gvfs-smb-1.54.4-5.el10_3.1.ppc64le.rpm SHA-256: 03831c75ec64c6e9c966e3d10e9d53659e589136cbbaa1c60ffd3e3f705dc2f3
gvfs-smb-debuginfo-1.54.4-5.el10_3.1.ppc64le.rpm SHA-256: 46df4d5797ccb6a137997df091a84b871556b306fdc1df90052ec9178ce055b1

Red Hat Enterprise Linux for ARM 64 10

SRPM
gvfs-1.54.4-5.el10_3.1.src.rpm SHA-256: e2353d8386649bb73fe0f118c3464af82fc8d5da41c972c172cccd0bab53e1cd
aarch64
gvfs-1.54.4-5.el10_3.1.aarch64.rpm SHA-256: fa1b13392a24634ec6776be4432e835ac68b360c78c88b2ad40d95d18ba74549
gvfs-client-1.54.4-5.el10_3.1.aarch64.rpm SHA-256: f3b1cc47ef2d16fbe1deff92c0eacd7033f691e81b3476de78a75c15b9ae5018
gvfs-client-debuginfo-1.54.4-5.el10_3.1.aarch64.rpm SHA-256: 9dcbc956dbeb4534711af342f642877620dada67b59137d015f1460dd547e2d3
gvfs-debuginfo-1.54.4-5.el10_3.1.aarch64.rpm SHA-256: e5b333540c0ffa73d0df07080200653e9d1afe7f49458c2c0f57304194a14647
gvfs-debugsource-1.54.4-5.el10_3.1.aarch64.rpm SHA-256: e977f611f25ff8078cdfe31666d166b6f51eaa5ab7b74a59ced76030dcf284b6
gvfs-fuse-1.54.4-5.el10_3.1.aarch64.rpm SHA-256: ea6d7e2194a7c698190579c0ce91866362b95e714ffeda1a9291603a9b591e3b
gvfs-fuse-debuginfo-1.54.4-5.el10_3.1.aarch64.rpm SHA-256: 47889d9bc065dd34f67d18f4cd30aeafb71e25b2dc27eef801d5d8c9674c519c
gvfs-goa-1.54.4-5.el10_3.1.aarch64.rpm SHA-256: cf4bb64726309938bce287d0acfa38eac803e25c7b2a330b9c62c034425d3896
gvfs-goa-debuginfo-1.54.4-5.el10_3.1.aarch64.rpm SHA-256: c519bfd7f24be0b9ca565f3c769621b8a315870ed621c0058edf0bd44ba40eab
gvfs-gphoto2-1.54.4-5.el10_3.1.aarch64.rpm SHA-256: 6372c567096b14f8e6f14823e02f3b9f993076eb983ee7ffb91bffc0272edaed
gvfs-gphoto2-debuginfo-1.54.4-5.el10_3.1.aarch64.rpm SHA-256: b7bf1df054bef6db00a689309f5c34946e7256fbebaa1e804d5841a5e14b02e6
gvfs-mtp-1.54.4-5.el10_3.1.aarch64.rpm SHA-256: 72cb2708223ecfadbf22559ef62f9d4c2ba546fed4abb4a951cb949a37872ec3
gvfs-mtp-debuginfo-1.54.4-5.el10_3.1.aarch64.rpm SHA-256: e96257d4e88dccaf88093dfb34f5c4c7c504ce124b58e34475054d13290c251e
gvfs-smb-1.54.4-5.el10_3.1.aarch64.rpm SHA-256: 275af86a4f066a9380d9e6a36be16729b586cf00ee09f39251a9ea2d97c051e6
gvfs-smb-debuginfo-1.54.4-5.el10_3.1.aarch64.rpm SHA-256: 990f4a1d0c84e75e2ee3999d23e6835f2d8dfcc02cc6326c7ecbbdd662550cad

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.