Back Linuxsecurity

Oracle gvfs Important Buffer Overflow Fix ELSA-2026

Linuxsecurity •LinuxSecurity Advisories • October 5, 2026

Running self-managed GitLab? Critical flaws could allow server code execution. Check the fixes. ×

[1.36.2-22] - Fix heap buffer overflow in SFTP backend (CVE-2026-84268) Resolves: RHEL-252300

gvfs-1.36.2-22.el8_10.i686.rpm gvfs-1.36.2-22.el8_10.x86_64.rpm gvfs-afc-1.36.2-22.el8_10.x86_64.rpm gvfs-afp-1.36.2-22.el8_10.x86_64.rpm gvfs-archive-1.36.2-22.el8_10.x86_64.rpm gvfs-client-1.36.2-22.el8_10.i686.rpm gvfs-client-1.36.2-22.el8_10.x86_64.rpm gvfs-devel-1.36.2-22.el8_10.i686.rpm gvfs-devel-1.36.2-22.el8_10.x86_64.rpm gvfs-fuse-1.36.2-22.el8_10.x86_64.rpm gvfs-goa-1.36.2-22.el8_10.x86_64.rpm gvfs-gphoto2-1.36.2-22.el8_10.x86_64.rpm gvfs-mtp-1.36.2-22.el8_10.x86_64.rpm gvfs-smb-1.36.2-22.el8_10.x86_64.rpm

gvfs-1.36.2-22.el8_10.aarch64.rpm gvfs-afc-1.36.2-22.el8_10.aarch64.rpm gvfs-afp-1.36.2-22.el8_10.aarch64.rpm gvfs-archive-1.36.2-22.el8_10.aarch64.rpm gvfs-client-1.36.2-22.el8_10.aarch64.rpm gvfs-devel-1.36.2-22.el8_10.aarch64.rpm gvfs-fuse-1.36.2-22.el8_10.aarch64.rpm gvfs-goa-1.36.2-22.el8_10.aarch64.rpm gvfs-gphoto2-1.36.2-22.el8_10.aarch64.rpm gvfs-mtp-1.36.2-22.el8_10.aarch64.rpm gvfs-smb-1.36.2-22.el8_10.aarch64.rpm

Related CVEs: CVE-2026-84268

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Oracle gvfs Buffer Overflow Vulnerabilities Prompt Updates On October 5, 2026, Oracle released updates for its gvfs software to address significant buffer overflow vulnerabilities identified as CVE-2026-84268 and CVE-2026-88924. These vulnerabilities could allow remote code execution on affected systems, particularly impacting users of Oracle Linux 8, 9, and 10. The updates include backported fixes for these CVEs, which were published on September 1 and September 10, 2026, respectively. Administrators running self-managed GitLab instances are particularly urged to apply these updates promptly to mitigate potential exploitation risks. The patches are available for multiple architectures, including x86_64 and aarch64. The vulnerabilities are classified as high severity, with CVE-2026-84268 rated at CVSS 8.8. Oracle has advised immediate action to secure systems against these threats. 3 sources 66

Extracted Entities

Oracle gvfs Important Buffer Overflow Fix ELSA-2026

The full story

Extracted Entities

CVEs (1)

CWE Weaknesses (1)

Vulnerabilities (1)