[CLSA-2026:1792212029] gvfs: Fix of CVE-2026-88924
Type:
security
Severity:
Important
Release date:
2026-10-17 04:40:41 UTC
Description:
- CVE-2026-88924: gvfsd-admin changed the ownership of its D-Bus socket with a link-following chown() after creating it in a user-controlled directory, allowing a local user to take ownership of arbitrary root-owned files; set the filesystem UID before creating the socket instead (upstream 371909dd)
CVEs fixed:
Updated packages:
  • gvfs-1.48.1-4.el9_2.tuxcare.els2.aarch64.rpm
    sha:ae08f78d6f1fecd5938ef018ee3670b766a641104b1d4843d86038dd69eb0bc7
  • gvfs-1.48.1-4.el9_2.tuxcare.els2.i686.rpm
    sha:b470aa409af117ec6dc50bed9ed1d46a96092f7532c910baa07e32aef43629ad
  • gvfs-1.48.1-4.el9_2.tuxcare.els2.x86_64.rpm
    sha:7d727b748485390db8e5d3ea4b6d3afbdcd4341c4d20229775b7f96f0ed6be18
  • gvfs-client-1.48.1-4.el9_2.tuxcare.els2.aarch64.rpm
    sha:5c3830c65305a36ebf063111a4d8dca69fbe65ddd0c0c2db1f6c86508454fb06
  • gvfs-client-1.48.1-4.el9_2.tuxcare.els2.i686.rpm
    sha:1344fb9de5556276a645022d5fb8893ec5ccde3ee67e578abf28c9cacc5e8c0c
  • gvfs-client-1.48.1-4.el9_2.tuxcare.els2.x86_64.rpm
    sha:c855dbae3d6fa95fca4b7a1a48edd27a420591be06ca633cf41d8200665964cd
  • gvfs-devel-1.48.1-4.el9_2.tuxcare.els2.aarch64.rpm
    sha:3bac3ca66edf2a832c47573de6db6d83d5b3fa8b8d205a6eab5698c14154e9d4
  • gvfs-devel-1.48.1-4.el9_2.tuxcare.els2.i686.rpm
    sha:85162eda55082fb56d4a7decc6da93378b6d3a34e84b1c7942dc054e8b558151
  • gvfs-devel-1.48.1-4.el9_2.tuxcare.els2.x86_64.rpm
    sha:e53c0767ff0eaece3f0aa4cd64f8a72866bb660879dd0007da7a1c677879411e
  • gvfs-fuse-1.48.1-4.el9_2.tuxcare.els2.aarch64.rpm
    sha:12b1315b2b0965616c23bb612fe674a99bd73961fdb76ce55a7e4290900473ba
  • gvfs-fuse-1.48.1-4.el9_2.tuxcare.els2.i686.rpm
    sha:feca85d6a90da3e67a8603d8ca25ca5dfb574c3038d7367ad49e820e3e160306
  • gvfs-fuse-1.48.1-4.el9_2.tuxcare.els2.x86_64.rpm
    sha:8dd7b846b9210e46f5e08809ae9b9acb63b72759d3f35040912fec641aa35c0f
  • gvfs-goa-1.48.1-4.el9_2.tuxcare.els2.aarch64.rpm
    sha:6f7b0f7f55242bcec3ab1506efe685e49d05850b3dbc6896be8ddc1c514f44d3
  • gvfs-goa-1.48.1-4.el9_2.tuxcare.els2.i686.rpm
    sha:419e587b07c17ae453c0791e9006a6cfa773c748ac7f6e8a297ef207e3aa464c
  • gvfs-goa-1.48.1-4.el9_2.tuxcare.els2.x86_64.rpm
    sha:99a511706ca0826a843dbe4c22a0a64fdb18d80948eb9c3abe40f310cbac39b7
  • gvfs-gphoto2-1.48.1-4.el9_2.tuxcare.els2.aarch64.rpm
    sha:916ffb92e1c0a1325eb05f4a0de2e7dff810e99b4806569d7aa03a568697c3b4
  • gvfs-gphoto2-1.48.1-4.el9_2.tuxcare.els2.i686.rpm
    sha:69b0601f49591c934ebf4fc636981b34cceb29d2960b08d100b5d6ff663f3d7d
  • gvfs-gphoto2-1.48.1-4.el9_2.tuxcare.els2.x86_64.rpm
    sha:75dbbfae916bf70ec1d38422ac17dedfa1526b2e01f88308596795c2c207ac92
  • gvfs-mtp-1.48.1-4.el9_2.tuxcare.els2.aarch64.rpm
    sha:4616bfb3d2dff18543f2753ac0a10b5c63c4fd1825a98cfc53ce4de0d8298c25
  • gvfs-mtp-1.48.1-4.el9_2.tuxcare.els2.i686.rpm
    sha:d43f28ea6c3d27ab2d40596aa6e8add0fe42250df51ec0f59069aaf32363f331
  • gvfs-mtp-1.48.1-4.el9_2.tuxcare.els2.x86_64.rpm
    sha:e1cecf2c61c1bda0fb89b1196eece2ec73444de234f349a8b1768bccf029b36d
  • gvfs-smb-1.48.1-4.el9_2.tuxcare.els2.aarch64.rpm
    sha:4303c071d377a20f376a34c1b384d16ddd407aa2540c25126e667601397d068e
  • gvfs-smb-1.48.1-4.el9_2.tuxcare.els2.i686.rpm
    sha:59db00297a7b16de7e332d2f5b9f09d42a304a2ca052f506a1328b6403f18312
  • gvfs-smb-1.48.1-4.el9_2.tuxcare.els2.x86_64.rpm
    sha:ec7496c165ba2309c5f8b9075c55211216b55280aa52acb88b14b47d92f8ebcb
  • gvfs-tests-1.48.1-4.el9_2.tuxcare.els2.aarch64.rpm
    sha:e3efb8ab180ee1780b4cd6bb279fb9b1628ab1a62ca00d4a77f90ea5be11ee92
  • gvfs-tests-1.48.1-4.el9_2.tuxcare.els2.i686.rpm
    sha:4e75df689bf74d5902aec246ef2967c91573524154b742721042d78b3e43c19c
  • gvfs-tests-1.48.1-4.el9_2.tuxcare.els2.x86_64.rpm
    sha:aadf117ad41357adc955131054b65055e8c144c018c52661331a1532de2315a0
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.