CVE-2026-84270: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-84270 is an out-of-bounds read vulnerability in the MTP (Media Transfer Protocol) backend of GNOME's gvfs virtual filesystem library. The flaw exists in the do_read() function within gvfsbackendmtp.c, which trusts the data length returned by a connected MTP device without validating it against the originally requested size. All gvfs versions prior to 1.60.2 are affected, with Red Hat Enterprise Linux also listed as an affected platform. The vulnerability was published on September 1, 2026, and carries a CVSS v3.1 base score of 4.3 (Medium) (Red Hat Advisory, Github Advisory).

The root cause is classified as CWE-125 (Out-of-bounds Read). When a file is read from a mounted MTP device, do_read() in gvfsbackendmtp.c accepts the data length value returned by the device at face value and passes it directly to memcpy() without capping it to the size originally requested by the client. If a malicious MTP device returns a length larger than expected, memcpy() reads memory beyond the intended buffer boundaries, triggering a segmentation fault and crashing the gvfsd-mtp process. Exploitation requires physical access — an attacker must plug in a specially crafted MTP device — and user interaction (a file read operation must be initiated) (Red Hat Advisory, Red Hat Bugzilla).

Successful exploitation causes the gvfsd-mtp daemon to crash via a segmentation fault, resulting in a denial of service for MTP device access. There is no confidentiality or integrity impact — the vulnerability does not expose sensitive data or allow modification of files. The scope is limited to the gvfsd-mtp process and does not enable lateral movement or privilege escalation (Red Hat Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.15%, placing it in the 4th percentile for exploitation likelihood within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is inherently limited by the requirement for physical device access, making mass exploitation impractical (Github Advisory, Feedly).

1. Prepare a malicious MTP device: Configure a USB device (e.g., using a microcontroller or modified Android device) to respond to MTP file read requests with a data length value larger than the actual data or the requested size.
2. Connect the device: Physically plug the malicious MTP device into a target Linux system running a vulnerable version of gvfs (< 1.60.2).
3. Trigger a file read: Wait for or socially engineer the target user to open or browse files on the mounted MTP device using a file manager (e.g., Nautilus) or any application that triggers a read via the gvfs MTP backend.
4. Trigger the crash: When do_read() in gvfsbackendmtp.c processes the device's inflated length value and passes it to memcpy(), memory is read out of bounds, causing a segmentation fault and crashing the gvfsd-mtp process — resulting in denial of service (Red Hat Advisory, Red Hat Bugzilla).

• Process: Unexpected termination or crash of the gvfsd-mtp process; absence of the gvfsd-mtp process after connecting an MTP device.
• Logs: Segmentation fault entries in system logs (e.g., /var/log/syslog or journalctl) referencing gvfsd-mtp; core dump files generated for the gvfsd-mtp process.
• File System: Unexpected core dump files (e.g., core or gvfsd-mtp.core) in the working directory or configured core dump location.
• Hardware Events: Kernel USB device connection logs (dmesg) showing an unrecognized or unusual MTP device being attached (Red Hat Advisory).

Update gvfs to version 1.60.2 or later, which contains the fix for this vulnerability (Red Hat Bugzilla). As an immediate workaround, Red Hat recommends not connecting untrusted or unknown MTP devices to affected systems (Red Hat Advisory). Additionally, organizations can enforce USB device allow-listing policies (e.g., via udev rules or endpoint security tools) to prevent unauthorized MTP devices from being mounted. Fedora users should apply the available update referenced in the Fedora security advisory (Linux Security).

Red Hat rated this vulnerability as Moderate severity, noting that physical access requirements and the denial-of-service-only impact limit its overall risk (Red Hat Advisory). Red Hat credited Keith Linneman of LinnemanLabs for responsibly reporting the issue. Community discussion has been minimal given the low EPSS score and physical access requirement, with automated CVE tracking bots on platforms like Bluesky noting the disclosure.