CVE-2026-84270: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-84270 is an out-of-bounds read vulnerability in the MTP (Media Transfer Protocol) backend of GNOME's gvfs virtual filesystem library. The flaw exists in the do_read() function within gvfsbackendmtp.c, which trusts the data length returned by a connected MTP device without validating it against the originally requested size. All gvfs versions prior to 1.60.2 are affected, with Red Hat Enterprise Linux also listed as an affected platform. The vulnerability was published on September 1, 2026, and carries a CVSS v3.1 base score of 4.3 (Medium) (Red Hat Advisory, Github Advisory).

The root cause is classified as CWE-125 (Out-of-bounds Read). When a file is read from a mounted MTP device, do_read() in gvfsbackendmtp.c accepts the data length value returned by the device at face value and passes it directly to memcpy() without capping it to the size originally requested by the client. If a malicious MTP device returns a larger-than-expected byte count, memcpy() reads memory beyond the intended buffer boundaries, triggering a segmentation fault and crashing the gvfsd-mtp process. Exploitation requires physical access (attack vector: Physical) and user interaction (e.g., a user reading a file from the mounted device), making it a low-complexity but physically-constrained attack (Red Hat Advisory, Red Hat Bugzilla).

Successful exploitation results in a denial of service by crashing the gvfsd-mtp daemon via a segmentation fault. There is no confidentiality or integrity impact — the vulnerability does not expose sensitive data or allow unauthorized modification of data. The scope is limited to the gvfsd-mtp process on the targeted system, with no evidence of lateral movement potential or privilege escalation (Red Hat Advisory, Github Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication (Red Hat Advisory). The NVD SSVC assessment confirms exploitation is "none" and the attack is not automatable, as it requires physical device connection. The EPSS score is approximately 0.15%, indicating a very low probability of exploitation in the near term (Github Advisory). No threat actor attribution or CISA KEV catalog listing has been identified for this CVE.

1. Prepare a malicious MTP device: Modify or program a USB device (e.g., using a microcontroller or custom firmware) to respond to MTP file read requests with a data length value larger than the actual data or the originally requested size.
2. Connect the device: Physically plug the malicious MTP device into a target Linux system running a vulnerable version of gvfs (< 1.60.2) where the gvfsd-mtp daemon is active.
3. Trigger device mounting: Wait for or induce the target user to mount the MTP device (e.g., via a file manager such as Nautilus), which causes gvfsd-mtp to connect to the device.
4. Initiate a file read: Cause the user to open or read a file from the mounted MTP device. This triggers do_read() in gvfsbackendmtp.c.
5. Trigger out-of-bounds read: The malicious device returns an inflated data length in its MTP response. do_read() passes this unchecked length to memcpy(), reading beyond the intended buffer boundary.
6. Achieve denial of service: The out-of-bounds memory access causes a segmentation fault, crashing the gvfsd-mtp process and disrupting MTP device access for the user (Red Hat Advisory, Red Hat Bugzilla).

• Process: Unexpected termination or crash of the gvfsd-mtp process; repeated restarts of gvfsd-mtp visible in process listings or service logs.
• Logs: Segmentation fault entries in system logs (e.g., /var/log/syslog or journalctl) referencing gvfsd-mtp; core dump files generated for the gvfsd-mtp process.
• File System: Presence of core dump files (e.g., core or gvfsd-mtp.core) in the working directory or configured core dump location.
• Hardware/USB: Connection of an unrecognized or unauthorized USB/MTP device logged in dmesg or udev event logs around the time of the crash.

Upgrade gvfs to version 1.60.2 or later, which fixes the out-of-bounds read by properly validating the data length returned by MTP devices against the originally requested size (Red Hat Bugzilla, Github Advisory). As a workaround, Red Hat recommends not connecting untrusted or unknown MTP devices to the system (Red Hat Advisory). Organizations can also enforce USB device allow-listing policies (e.g., via udev rules or endpoint security tools) to prevent unauthorized MTP devices from being mounted. A Fedora 43 advisory addressing this issue has also been published (Linux Security).

Red Hat credited Keith Linneman of LinnemanLabs for responsibly reporting this vulnerability (Red Hat Advisory). Red Hat rated the vulnerability as Moderate severity, noting that physical access is required and the direct impact is limited to denial of service with no information disclosure. Community discussion has been minimal given the low severity and physical access requirement, with standard CVE tracking activity observed across vulnerability databases and a brief mention on Bluesky.