A flaw was found in the admin backend of gvfs. The privileged gvfsd-admin daemon changes the ownership of newly created private D-Bus sockets by calling the link-following chown() function on a pathname inside a user-controlled directory. A local attacker can exploit this via a Time-of-Check Time-of-Use (TOCTOU) race condition and exchange the socket pathname with a symbolic link pointing to an arbitrary root-owned file (such as /etc/pam.d/su). The daemon subsequently follows the symlink and changes the ownership of the targeted root-owned file to the attacker's user ID. This allows an authenticated local attacker to modify critical system files, leading to a full local privilege escalation to root.

oracle_linux ELSA-2026-73998: ELSA-2026-73998:  gvfs security update (IMPORTANT)

ubuntu_linux USN-8845-1: Ubuntu 16.04 LTS / Ubuntu 18.04 LTS / Ubuntu 20.04 LTS / Ubuntu 22.04 LTS / Ubuntu 24.04 LTS / Ubuntu 26.04 LTS / Ubuntu Pro Realtime 24.04 LTS : GVfs vulnerabilities (USN-8845-1)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-74370 advisory.

    [1.48.1-8.1]
    - Backport several CVE fixes (CVE-2026-84268, CVE-2026-88924)       Resolves: RHEL-252312, RHEL-257348

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:73998 advisory.

    * gvfs: SFTP: heap-based buffer overflow in read_reply() (CVE-2026-84268)
      * gvfs: gvfs-admin socket ownership race permits local root (CVE-2026-88924)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:74370 advisory.

    * gvfs: SFTP: heap-based buffer overflow in read_reply() (CVE-2026-84268)
      * gvfs: gvfs-admin socket ownership race permits local root (CVE-2026-88924)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:74370 advisory.

    GVFS is the GNOME Desktop Virtual File System layer that allows users to easily access local and remote     data using File Transfer Protocol (FTP), Secure Shell File Transfer Protocol (SFTP), Web Distributed     Authoring and Versioning (WebDAV), Common Internet File System (CIFS), Server Message Block (SMB), and     other protocols. GVFS integrates with the GNOME I/O (GIO) abstraction layer.

    Security Fix(es):

    * gvfs: SFTP: heap-based buffer overflow in read_reply() (CVE-2026-84268)

    * gvfs: gvfs-admin socket ownership race permits local root (CVE-2026-88924)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:73998 advisory.

    * gvfs: SFTP: heap-based buffer overflow in read_reply() (CVE-2026-84268)

    * gvfs: gvfs-admin socket ownership race permits local root (CVE-2026-88924)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:73998 advisory.

    GVFS is the GNOME Desktop Virtual File System layer that allows users to easily access local and remote     data using File Transfer Protocol (FTP), Secure Shell File Transfer Protocol (SFTP), Web Distributed     Authoring and Versioning (WebDAV), Common Internet File System (CIFS), Server Message Block (SMB), and     other protocols. GVFS integrates with the GNOME I/O (GIO) abstraction layer.

    Security Fix(es):

    * gvfs: SFTP: heap-based buffer overflow in read_reply() (CVE-2026-84268)

    * gvfs: gvfs-admin socket ownership race permits local root (CVE-2026-88924)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3120 advisory.

    A flaw was found in the SFTP backend in gvfs. When mounting a share and reading a file, a malicious SFTP     server can cause read_reply() to process a length that exceeds the size requested by the client. The     function does not verify the server-provided length against the allocated buffer size, causing the     operation to write past the intended boundaries. This issue allows a malicious server to corrupt adjacent     heap memory in the gvfsd-sftp process, resulting in a denial of service as the process aborts upon     detecting the heap corruption or potentially allowing arbitrary code execution. (CVE-2026-84268)

    A flaw was found in the admin backend of gvfs. The privileged gvfsd-admin daemon changes the ownership of     newly created private D-Bus sockets by calling the link-following chown() function on a pathname inside a     user-controlled directory. A local attacker can exploit this via a Time-of-Check Time-of-Use (TOCTOU) race     condition and exchange the socket pathname with a symbolic link pointing to an arbitrary root-owned file     (such as /etc/pam.d/su). The daemon subsequently follows the symlink and changes the ownership of the     targeted root-owned file to the attacker's user ID. This allows an authenticated local attacker to modify     critical system files, leading to a full local privilege escalation to root. (CVE-2026-88924)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:1011 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2026-88924:
    A flaw was found in the admin backend of gvfs. The privileged gvfsd-admin daemon changes the ownership of     newly created private D-Bus sockets by calling the link-following chown() function on a pathname inside a     user-controlled directory. A local attacker can exploit this via a Time-of-Check Time-of-Use (TOCTOU) race     condition and exchange the socket pathname with a symbolic link pointing to an arbitrary root-owned file     (such as /etc/pam.d/su). The daemon subsequently follows the symlink and changes the ownership of the     targeted root-owned file to the attacker's user ID. This allows an authenticated local attacker to modify     critical system files, leading to a full local privilege escalation to root.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in the admin backend of gvfs. The privileged gvfsd-admin daemon changes the ownership of     newly created private D-Bus sockets by calling the link-following chown() function on a pathname inside a     user-controlled directory. A local attacker can exploit this via a Time-of-Check Time-of-Use (TOCTOU) race     condition and exchange the socket pathname with a symbolic link pointing to an arbitrary root-owned file     (such as /etc/pam.d/su). The daemon subsequently follows the symlink and changes the ownership of the     targeted root-owned file to the attacker's user ID. This allows an authenticated local attacker to modify     critical system files, leading to a full local privilege escalation to root. (CVE-2026-88924)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
362415	Oracle Linux 9 : gvfs (ELSA-2026-74370)	Nessus	Oracle Linux Local Security Checks	Local	high
362408	AlmaLinux 10 : gvfs (ALSA-2026:73998)	Nessus	Alma Linux Local Security Checks	Local	high
362402	AlmaLinux 9 : gvfs (ALSA-2026:74370)	Nessus	Alma Linux Local Security Checks	Local	high
362391	RHEL 9 : gvfs (RHSA-2026:74370)	Nessus	Red Hat Local Security Checks	Local	high
359464	RockyLinux 10 : gvfs (RLSA-2026:73998)	Nessus	Rocky Linux Local Security Checks	Local	high
351861	RHEL 10 : gvfs (RHSA-2026:73998)	Nessus	Red Hat Local Security Checks	Local	high
351058	Amazon Linux 2023 : gvfs, gvfs-archive, gvfs-client (ALAS2023-2026-3120)	Nessus	Amazon Linux Local Security Checks	Local	high
346447	TencentOS Server 4: gvfs (TSSA-2026:1011)	Nessus	Tencent Local Security Checks	Local	high
344592	Linux Distros Unpatched Vulnerability : CVE-2026-88924	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-88924

high

Tenable Plugins

Coming Soon

high

high

high

high

high

high

high

high

high