Amazon Linux 2027 Preview Security Advisory: ALAS2027-2026-092
Advisory Release Date: 2026-09-28 09:00 Pacific
Advisory Updated Date: 2026-09-28 09:00 Pacific
A flaw was found in the MTP backend in gvfs. When reading a file from a mounted MTP device, do_read() in gvfsbackendmtp.c trusts the data length returned by the device without limiting it to the original size requested by the client. If a malicious MTP device responds with more bytes than requested, this unrestricted length is passed directly to memcpy(). This causes the operation to read memory outside the intended boundaries. This allows an attacker who plugs in a malicious MTP device to cause a segmentation fault when a file is read and crash the gvfsd-mtp process, resulting in a denial of service. (CVE-2026-84270)
A flaw was found in the admin backend of gvfs. The privileged gvfsd-admin daemon changes the ownership of newly created private D-Bus sockets by calling the link-following chown() function on a pathname inside a user-controlled directory. A local attacker can exploit this via a Time-of-Check Time-of-Use (TOCTOU) race condition and exchange the socket pathname with a symbolic link pointing to an arbitrary root-owned file (such as /etc/pam.d/su). The daemon subsequently follows the symlink and changes the ownership of the targeted root-owned file to the attacker's user ID. This allows an authenticated local attacker to modify critical system files, leading to a full local privilege escalation to root. (CVE-2026-88924)
Affected Packages:
gvfs
Issue Correction:
Run yum update gvfs to update your system.
aarch64:
gvfs-client-debuginfo-1.60.2-2.amzn2027.aarch64
gvfs-nfs-debuginfo-1.60.2-2.amzn2027.aarch64
gvfs-smb-debuginfo-1.60.2-2.amzn2027.aarch64
gvfs-smb-1.60.2-2.amzn2027.aarch64
gvfs-client-1.60.2-2.amzn2027.aarch64
gvfs-goa-debuginfo-1.60.2-2.amzn2027.aarch64
gvfs-fuse-debuginfo-1.60.2-2.amzn2027.aarch64
gvfs-goa-1.60.2-2.amzn2027.aarch64
gvfs-fuse-1.60.2-2.amzn2027.aarch64
gvfs-nfs-1.60.2-2.amzn2027.aarch64
gvfs-debuginfo-1.60.2-2.amzn2027.aarch64
gvfs-1.60.2-2.amzn2027.aarch64
gvfs-debugsource-1.60.2-2.amzn2027.aarch64
src:
gvfs-1.60.2-2.amzn2027.src
x86_64:
gvfs-debuginfo-1.60.2-2.amzn2027.x86_64
gvfs-smb-debuginfo-1.60.2-2.amzn2027.x86_64
gvfs-nfs-debuginfo-1.60.2-2.amzn2027.x86_64
gvfs-goa-debuginfo-1.60.2-2.amzn2027.x86_64
gvfs-goa-1.60.2-2.amzn2027.x86_64
gvfs-fuse-debuginfo-1.60.2-2.amzn2027.x86_64
gvfs-smb-1.60.2-2.amzn2027.x86_64
gvfs-client-1.60.2-2.amzn2027.x86_64
gvfs-client-debuginfo-1.60.2-2.amzn2027.x86_64
gvfs-fuse-1.60.2-2.amzn2027.x86_64
gvfs-nfs-1.60.2-2.amzn2027.x86_64
gvfs-1.60.2-2.amzn2027.x86_64
gvfs-debugsource-1.60.2-2.amzn2027.x86_64