libblockdev CVE-2026-111581

Requires an authenticated LOCAL unprivileged user with access to the system D-Bus and the udisks2 Filesystem.SetLabel() method; the attacker must supply a label value that begins with a '-' character to an NTFS or VFAT volume, triggering libblockdev's bd_fs_ntfs_set_label() / bd_fs_vfat_set_label() which invoke ntfslabel/fatlabel without a '--' end-of-options separator or dash-value validation. Limiting factors: exploitation is strictly local (no network vector), requires an active D-Bus/session login (PR:L), is confined to systems using udisks2 on top of libblockdev with NTFS/VFAT label-setting, and yields only low integrity impact (no confidentiality or availability effect, no privilege escalation), substantially capping real-world risk despite the trivial attack complexity.

All signals converge on this being a genuinely LOW-priority issue rather than a high-CVSS-but-overblown one. The provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, base 3.3) indicates a LOCAL attack vector requiring an authenticated unprivileged session (PR:L), with only LOW integrity impact and no confidentiality or availability impact. This is consistent with the description: exploitation is reachable only by unprivileged LOCAL users via the udisks2 Filesystem.SetLabel() D-Bus method, not remotely. No EPSS score was supplied; no CISA KEV listing is present (not actively exploited); and no public POC is referenced - so exploitation status is 'no public exploit identified at time of analysis.' No SSVC decision data was provided. The CWE-88 (argument injection) mechanism is real and plausible, but the practical ceiling is low: an attacker who already has a local session can only coerce the ntfslabel/fatlabel helpers into misinterpreting a dash-prefixed label as a flag, yielding limited, device-label-scoped integrity effects rather than privilege escalation or code execution. Note a minor tension to verify: the 'Authentication Bypass' tag overstates the flaw - the description and CWE-88 point to argument injection, and the 'without administrator authentication' phrasing describes the normal unprivileged D-Bus path, not a true auth bypass.

A logged-in unprivileged local user (or a compromised local process with an active desktop/D-Bus session) invokes the udisks2 Filesystem.SetLabel() D-Bus method and supplies an NTFS or VFAT volume label beginning with '-'. Because libblockdev passes the label as a bare positional argument to ntfslabel/fatlabel without a '--' end-of-options separator, the spawned utility interprets the value as a command-line flag, potentially bypassing safety checks or triggering unintended operations on the target filesystem. No public exploit code is identified at time of analysis, and the low CVSS complexity reflects that crafting the malicious label is trivial once local D-Bus access exists.