util-linux libblkid CVE-2026-13595

Exploitation specifically requires a crafted block device image that exercises nested partition probing via BSD, Minix, Solaris x86, or UnixWare partition table formats and triggers at least one array reallocation while a parent-partition pointer is cached. The attacker must be able to present this image to the target system either through physical USB port access or by inducing automatic processing of a loop-mountable image. No system account or authentication is required because udev and udisks invoke libblkid automatically as root on block-device hot-plug events - the kernel and udev handle device enumeration without any user credential check. Exploitation is limited to systems running udev and udisks with automatic block device probing enabled (the default on most Linux desktop and server installations). Remote network exploitation is not possible given the local attack vector (AV:L). The flaw does not apply to systems where USB mass-storage is disabled at the kernel or BIOS level, or where udisks automatic probing has been restricted via polkit policy.

The CVSS 3.1 score of 6.8 Medium with vector AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H accurately reflects the attack profile. The local attack vector (AV:L) is the primary risk-limiting factor: exploitation requires either physical USB port access or the ability to present a crafted loop-mountable image, ruling out remote network-based mass exploitation. However, PR:N and UI:N are accurate and significant - because udev and udisks invoke libblkid as root automatically, an attacker needs zero system credentials and zero victim cooperation. USB-drop physical attacks are well within realistic threat models for enterprise environments, shared workstations, and public-facing kiosks. No EPSS score was provided in the input data; given the local vector, broad automated exploitation is implausible, but targeted physical attacks are credible. KEV status is absent, and no public POC is known, so the real-world exploitation risk currently sits at the theoretical-to-low tier. The A:H component warrants attention because udisks is a privileged root service whose crash disrupts automounting infrastructure; repeated triggered crashes constitute a persistent denial of service. The C:L component acknowledges potential heap data leakage from the root process's address space, but practical exploitation beyond a memory leak has not been demonstrated.

An attacker crafts a USB drive or disk image containing deeply nested BSD or Minix partition tables engineered so that libblkid's partition array reallocates at least once while a cached parent-partition pointer is still live. Upon physical insertion of the USB device into a target Linux workstation or server, udev automatically triggers udisks to probe the device using libblkid as root - no login, no prompt, no click required. The stale pointer dereference crashes the udisks service (denial of service) or exposes bytes from the root process heap adjacent to the freed partition struct, potentially leaking sensitive data.