rpm package
almalinux/libblkid
pkg:rpm/almalinux/libblkid
Vulnerabilities (10)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-53615 | Hig | 8.0 | < 2.40.2-18.el10_2.20 | 2.40.2-18.el10_2.20 | Oct 14, 2026 | util-linux is a random collection of Linux utilities. Before util-linux 2.41.4, `parse_dos_extended()` in `libblkid/src/partitions/dos.c` computes an extended-partition start sector with 32-bit addition and does not apply the extended-area bounds checks to the first two EBR entri | |
| CVE-2026-53614 | Hig | 7.0 | < 2.40.2-18.el10_2.20 | 2.40.2-18.el10_2.20 | Oct 14, 2026 | util-linux is a random collection of Linux utilities. In util-linux 2.39.1 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility reads the attacker-controlled `LIBMOUNT_FORCE_MOUNT2` environment variable with `getenv()`, allowing a local low-privileged user to force th | |
| CVE-2026-53613 | Hig | 7.0 | < 2.40.2-18.el10_2.20 | 2.40.2-18.el10_2.20 | Oct 14, 2026 | util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy `mount(2)` path is used without `/proc`, restricted non-root `mount` requests validate an `/etc/fstab` target before the mount operation | |
| CVE-2026-53612 | Hig | 7.0 | < 2.40.2-18.el10_2.20 | 2.40.2-18.el10_2.20 | Oct 14, 2026 | util-linux is a random collection of Linux utilities. In util-linux 2.39 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility's `hook_owner.c` post-mount hook performs path-based `chmod()` and `lchown()` operations on a previously validated mount target. A local low-p | |
| CVE-2026-76642 | Hig | 7.8 | < 2.40.2-18.el10_2.20 | 2.40.2-18.el10_2.20 | Sep 3, 2026 | util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone file | |
| CVE-2026-78410 | Hig | 7.8 | < 2.40.2-18.el10_2.20 | 2.40.2-18.el10_2.20 | Sep 2, 2026 | A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host di | |
| CVE-2026-78408 | Hig | 7.9 | < 2.40.2-18.el10_2.20 | 2.40.2-18.el10_2.20 | Sep 2, 2026 | The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a pr | |
| CVE-2026-13595 | Med | 6.8 | < 2.40.2-18.el10_2.20 | 2.40.2-18.el10_2.20 | Jun 29, 2026 | A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the arr | |
| CVE-2026-27456 | Med | 4.7 | < 2.40.2-18.el10_2.20 | 2.40.2-18.el10_2.20 | Apr 3, 2026 | util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path | |
| CVE-2025-14104 | Med | 6.1 | < 2.40.2-15.el10_1 | 2.40.2-15.el10_1 | Dec 5, 2025 | A flaw was found in util-linux. This vulnerability allows a heap buffer overread when processing 256-byte usernames, specifically within the `setpwnam()` function, affecting SUID (Set User ID) login-utils utilities writing to the password database. |
- affected < 2.40.2-18.el10_2.20fixed 2.40.2-18.el10_2.20
util-linux is a random collection of Linux utilities. Before util-linux 2.41.4, `parse_dos_extended()` in `libblkid/src/partitions/dos.c` computes an extended-partition start sector with 32-bit addition and does not apply the extended-area bounds checks to the first two EBR entri
- affected < 2.40.2-18.el10_2.20fixed 2.40.2-18.el10_2.20
util-linux is a random collection of Linux utilities. In util-linux 2.39.1 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility reads the attacker-controlled `LIBMOUNT_FORCE_MOUNT2` environment variable with `getenv()`, allowing a local low-privileged user to force th
- affected < 2.40.2-18.el10_2.20fixed 2.40.2-18.el10_2.20
util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy `mount(2)` path is used without `/proc`, restricted non-root `mount` requests validate an `/etc/fstab` target before the mount operation
- affected < 2.40.2-18.el10_2.20fixed 2.40.2-18.el10_2.20
util-linux is a random collection of Linux utilities. In util-linux 2.39 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility's `hook_owner.c` post-mount hook performs path-based `chmod()` and `lchown()` operations on a previously validated mount target. A local low-p
- affected < 2.40.2-18.el10_2.20fixed 2.40.2-18.el10_2.20
util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone file
- affected < 2.40.2-18.el10_2.20fixed 2.40.2-18.el10_2.20
A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host di
- affected < 2.40.2-18.el10_2.20fixed 2.40.2-18.el10_2.20
The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a pr
- affected < 2.40.2-18.el10_2.20fixed 2.40.2-18.el10_2.20
A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the arr
- affected < 2.40.2-18.el10_2.20fixed 2.40.2-18.el10_2.20
util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path
- affected < 2.40.2-15.el10_1fixed 2.40.2-15.el10_1
A flaw was found in util-linux. This vulnerability allows a heap buffer overread when processing 256-byte usernames, specifically within the `setpwnam()` function, affecting SUID (Set User ID) login-utils utilities writing to the password database.