CVE-2026-84270: 
Linux Debian Analyse et atténuation des vulnérabilités

CVE-2026-84270 is an out-of-bounds read vulnerability in the MTP (Media Transfer Protocol) backend of gvfs, the GNOME virtual filesystem. The flaw exists in the do_read() function within gvfsbackendmtp.c, which trusts the data length returned by a connected MTP device without validating it against the originally requested size. A malicious MTP device can exploit this to crash the gvfsd-mtp process, resulting in a denial of service. The vulnerability affects all gvfs versions and is fixed in version 1.60.2, with Red Hat Enterprise Linux identified as an affected platform. It carries a CVSS v3.1 base score of 4.3 (Medium) (Red Hat Advisory, Github Advisory).

The root cause is classified as CWE-125 (Out-of-bounds Read). In gvfsbackendmtp.c, the do_read() function passes the data length reported by the MTP device directly to memcpy() without capping it to the size originally requested by the client. If a malicious device returns a larger-than-expected byte count, memcpy() reads memory beyond the intended buffer boundaries, triggering a segmentation fault. Exploitation requires physical access — an attacker must plug in a specially crafted MTP device and wait for a user to read a file from it (user interaction required). No public proof-of-concept code has been identified (Red Hat Advisory, Red Hat Bugzilla).

Successful exploitation causes the gvfsd-mtp daemon to crash via a segmentation fault, resulting in a denial of service for MTP device file access. There is no confidentiality or integrity impact — the vulnerability does not expose sensitive data or allow unauthorized modification of files. The scope is limited to the affected gvfsd-mtp process and does not enable lateral movement or privilege escalation (Red Hat Advisory).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and the EPSS score is 0.0, reflecting a very low probability of exploitation in the near term. Exploitation is inherently constrained by the requirement for physical device access and user interaction. The vulnerability was reported by Keith Linneman of LinnemanLabs and disclosed on September 1, 2026 (Red Hat Advisory, Github Advisory).

1. Prepare a malicious MTP device: Craft or program a USB device (e.g., using a microcontroller or modified firmware) that implements the MTP protocol but responds to file read requests with a data length field larger than the actual data or the requested size.
2. Connect the device: Physically plug the malicious MTP device into a target Linux system running a vulnerable version of gvfs (prior to 1.60.2).
3. Trigger device mounting: Wait for or socially engineer the target user to interact with the mounted MTP device (e.g., opening a file manager that auto-mounts the device).
4. Initiate a file read: The user reads a file from the mounted MTP device, causing gvfsd-mtp to call do_read() in gvfsbackendmtp.c.
5. Trigger the out-of-bounds read: The malicious device returns an inflated data length; do_read() passes this unchecked length to memcpy(), reading beyond the buffer boundary and causing a segmentation fault that crashes the gvfsd-mtp process (Red Hat Advisory, Red Hat Bugzilla).

• Process: Unexpected termination or crash of the gvfsd-mtp process; core dump files generated for gvfsd-mtp in /var/lib/systemd/coredump/ or /tmp/.
• Logs: Segmentation fault entries in system logs (e.g., /var/log/messages or journalctl) referencing gvfsd-mtp; entries such as gvfsd-mtp[PID]: segfault at ... in kernel logs.
• File System: Unexpected core dump files associated with the gvfsd-mtp process.
• Hardware/USB: Unrecognized or unusual USB/MTP device connections logged in dmesg or udev logs around the time of the crash (Red Hat Advisory).

Update gvfs to version 1.60.2 or later, which contains the fix for this vulnerability (Red Hat Bugzilla). As a workaround, Red Hat recommends not connecting untrusted or unknown MTP devices to the system (Red Hat Advisory). Additionally, organizations can enforce USB device allow-listing policies (e.g., via udev rules or endpoint security tools) to prevent unauthorized MTP devices from being mounted, and restrict physical access to systems to trusted personnel only.

Red Hat rated this vulnerability as Moderate severity, noting that physical access is required and the direct impact is limited to denial of service with no information disclosure (Red Hat Advisory). The vulnerability was credited to Keith Linneman of LinnemanLabs. Community discussion has been minimal, consistent with the low EPSS score and physical-access-only attack vector.