
Cloud Vulnerability DB
A community-led vulnerabilities database
CVE-2026-84270 is an out-of-bounds read vulnerability in the MTP (Media Transfer Protocol) backend of GNOME's gvfs virtual filesystem library. The flaw exists in the do_read() function within gvfsbackendmtp.c, which trusts the data length returned by a connected MTP device without validating it against the originally requested size. All gvfs versions prior to 1.60.2 are affected, with Red Hat Enterprise Linux also listed as an affected platform. The vulnerability was published on September 1, 2026, and carries a CVSS v3.1 base score of 4.3 (Medium) (Red Hat Advisory, Github Advisory).
The root cause is classified as CWE-125 (Out-of-bounds Read). When a file is read from a mounted MTP device, do_read() in gvfsbackendmtp.c accepts the data length value returned by the device at face value and passes it directly to memcpy() without capping it to the size originally requested by the client. If a malicious MTP device returns a larger-than-expected byte count, memcpy() reads memory beyond the intended buffer boundaries, triggering a segmentation fault and crashing the gvfsd-mtp process. Exploitation requires physical access (attack vector: Physical) and user interaction (e.g., a user reading a file from the mounted device), making it a low-complexity but physically-constrained attack (Red Hat Advisory, Red Hat Bugzilla).
Successful exploitation results in a denial of service by crashing the gvfsd-mtp daemon via a segmentation fault. There is no confidentiality or integrity impact — the vulnerability does not expose sensitive data or allow unauthorized modification of data. The scope is limited to the gvfsd-mtp process on the targeted system, with no evidence of lateral movement potential or privilege escalation (Red Hat Advisory, Github Advisory).
There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication (Red Hat Advisory). The NVD SSVC assessment confirms exploitation is "none" and the attack is not automatable, as it requires physical device connection. The EPSS score is approximately 0.15%, indicating a very low probability of exploitation in the near term (Github Advisory). No threat actor attribution or CISA KEV catalog listing has been identified for this CVE.
gvfsd-mtp daemon is active.gvfsd-mtp to connect to the device.do_read() in gvfsbackendmtp.c.do_read() passes this unchecked length to memcpy(), reading beyond the intended buffer boundary.gvfsd-mtp process and disrupting MTP device access for the user (Red Hat Advisory, Red Hat Bugzilla).gvfsd-mtp process; repeated restarts of gvfsd-mtp visible in process listings or service logs./var/log/syslog or journalctl) referencing gvfsd-mtp; core dump files generated for the gvfsd-mtp process.core or gvfsd-mtp.core) in the working directory or configured core dump location.dmesg or udev event logs around the time of the crash.Upgrade gvfs to version 1.60.2 or later, which fixes the out-of-bounds read by properly validating the data length returned by MTP devices against the originally requested size (Red Hat Bugzilla, Github Advisory). As a workaround, Red Hat recommends not connecting untrusted or unknown MTP devices to the system (Red Hat Advisory). Organizations can also enforce USB device allow-listing policies (e.g., via udev rules or endpoint security tools) to prevent unauthorized MTP devices from being mounted. A Fedora 43 advisory addressing this issue has also been published (Linux Security).
Red Hat credited Keith Linneman of LinnemanLabs for responsibly reporting this vulnerability (Red Hat Advisory). Red Hat rated the vulnerability as Moderate severity, noting that physical access is required and the direct impact is limited to denial of service with no information disclosure. Community discussion has been minimal given the low severity and physical access requirement, with standard CVE tracking activity observed across vulnerability databases and a brief mention on Bluesky.
Fix availability across major Linux distributions and their releases.
bionic (esm-infra)
gvfs
devel
gvfs
focal (esm-infra)
gvfs
jammy
gvfs
noble
gvfs
resolute
gvfs
xenial (esm-infra-legacy)
gvfs
Source: This report was generated using AI
Free Vulnerability Assessment
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
"Best User Experience I have ever seen, provides full visibility to cloud workloads."
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
"We know that if Wiz identifies something as critical, it actually is."