Back Linuxsecurity

Oracle gvfs Important Security Advisory ELSA-2026

Linuxsecurity •LinuxSecurity Advisories • October 5, 2026

Running self-managed GitLab? Critical flaws could allow server code execution. Check the fixes. ×

[1.54.4-4.1] - Backport several CVE fixes (CVE-2026-84268, CVE-2026-88924) Resolves: RHEL-252305, RHEL-257341 [1.54.4-4] - udisks2: Correct add to hash table for items which can clash in the monitor (RHEL-143935)

gvfs-1.54.4-4.el10_2.1.x86_64.rpm gvfs-client-1.54.4-4.el10_2.1.x86_64.rpm gvfs-fuse-1.54.4-4.el10_2.1.x86_64.rpm gvfs-goa-1.54.4-4.el10_2.1.x86_64.rpm gvfs-gphoto2-1.54.4-4.el10_2.1.x86_64.rpm gvfs-mtp-1.54.4-4.el10_2.1.x86_64.rpm gvfs-smb-1.54.4-4.el10_2.1.x86_64.rpm

gvfs-1.54.4-4.el10_2.1.aarch64.rpm gvfs-client-1.54.4-4.el10_2.1.aarch64.rpm gvfs-fuse-1.54.4-4.el10_2.1.aarch64.rpm gvfs-goa-1.54.4-4.el10_2.1.aarch64.rpm gvfs-gphoto2-1.54.4-4.el10_2.1.aarch64.rpm gvfs-mtp-1.54.4-4.el10_2.1.aarch64.rpm gvfs-smb-1.54.4-4.el10_2.1.aarch64.rpm

Related CVEs: CVE-2026-84268 CVE-2026-88924

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Oracle gvfs Buffer Overflow Vulnerabilities Prompt Updates On October 5, 2026, Oracle released updates for its gvfs software to address significant buffer overflow vulnerabilities identified as CVE-2026-84268 and CVE-2026-88924. These vulnerabilities could allow remote code execution on affected systems, particularly impacting users of Oracle Linux 8, 9, and 10. The updates include backported fixes for these CVEs, which were published on September 1 and September 10, 2026, respectively. Administrators running self-managed GitLab instances are particularly urged to apply these updates promptly to mitigate potential exploitation risks. The patches are available for multiple architectures, including x86_64 and aarch64. The vulnerabilities are classified as high severity, with CVE-2026-84268 rated at CVSS 8.8. Oracle has advised immediate action to secure systems against these threats. 3 sources 66

Extracted Entities

CVEs (2)

CVE-2026-84268 CVE-2026-88924

Platforms (1)

Linux