Skip to main content

util-linux libblkid CVE-2026-13595

| EUVDEUVD-2026-40053 MEDIUM
Use After Free (CWE-416)
2026-06-29 redhat GHSA-qpmf-9p9c-455w
Denial Of Service Information Disclosure Use After Free Memory Corruption Red Hat Enterprise Linux 10 Red Hat Enterprise Linux 7 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 9 Red Hat Openshift Container Platform 4 Red Hat Hardened Images Red Hat
5.3
CVSS 3.1 · NVD
Share

Severity by source

Vendor (redhat) PRIMARY
MEDIUM
qualitative
NVD
5.3 MEDIUM
AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H
vuln.today AI
6.8 MEDIUM

AV:L because block device presentation is required; PR:N because udev invokes libblkid as root automatically without attacker credentials; A:H for privileged service crash; C:L for bounded heap read leak.

3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
6.1 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
Red Hat
6.8 MEDIUM
qualitative

Primary rating from Vendor (redhat).

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
High

Lifecycle Timeline

4
CVSS changed
Jul 08, 2026 - 03:52 NVD
6.8 (MEDIUM) 5.3 (MEDIUM)
Source Code Evidence Fetched
Jun 29, 2026 - 09:19 vuln.today
Analysis Generated
Jun 29, 2026 - 09:19 vuln.today
CVE Published
Jun 29, 2026 - 08:06 cve.org
MEDIUM 6.8

DescriptionNVD

A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.

AnalysisAI

Heap use-after-free read in libblkid (util-linux) enables unauthenticated local attackers to crash udisks or leak root-process heap data by presenting a crafted block device image during nested partition probing. BSD, Minix, Solaris x86, and UnixWare partition table parsers cache raw pointers into a dynamically allocated partition array; when subsequent partition additions trigger array reallocation, those pointers become stale and dereference freed memory. Because udev and udisks invoke libblkid automatically as root on block-device hot-plug events, USB insertion alone is sufficient to trigger the flaw without any user interaction or authentication. No public exploit identified at time of analysis.

Technical ContextAI

libblkid is the block-device identification library within the util-linux package, invoked by udev and udisks as root to detect filesystem types and partition table schemes on newly presented block devices. The root cause (CWE-416: Use After Free) resides in the new_partition() function in libblkid/src/partitions/partitions.c, where the blkid_partlist structure previously stored all partition entries in a contiguous flat array (blkid_partition parts). Partition probers for nested formats - BSD, Minix, Solaris x86, UnixWare - cached direct C pointers (interior addresses into that array) to reference parent partition entries. When the flat array grew past its current allocation and realloc() moved it to a new heap address, all previously cached interior pointers became dangling. The upstream fix (commit c0186f14) restructures storage as an array of pointers (blkid_partition *parts) with each blkid_struct_partition individually heap-allocated via calloc(), ensuring that array reallocation only moves the pointer array itself, not the individual partition objects, making all cached pointers permanently stable.

RemediationAI

Apply vendor-supplied updates via standard package management (dnf update util-linux on RHEL systems) once a fixed package version is released by Red Hat - monitor https://access.redhat.com/security/cve/CVE-2026-13595 for the official advisory with exact patched package versions. The upstream fix is confirmed available as commit c0186f14fbdb02f64c8e0ba701ce727ea764ff4c in the util-linux GitHub repository (https://github.com/util-linux/util-linux/commit/c0186f14fbdb02f64c8e0ba701ce727ea764ff4c), but a specific tagged release version incorporating this commit has not been confirmed in the available data. As a compensating control where patching is not immediately possible, USB mass-storage probing can be blocked by adding install usb-storage /bin/true to /etc/modprobe.d/disable-usb-storage.conf - note this disables all USB mass-storage peripherals including legitimate removable media. Alternatively, configuring udisks via polkit rules to restrict automatic block device probing reduces the attack surface without fully disabling USB, though implementation complexity is higher. In high-security or kiosk environments, physically disabling USB ports via BIOS/UEFI settings provides the most robust mitigation at the cost of all USB peripheral functionality.

More in Red Hat Enterprise Linux 10

View all
CVE-2026-18663 MEDIUM
5.9 Aug 12

Heap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
CVE-2026-4631 CRITICAL POC
9.8 Apr 07

Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
CVE-2026-4480 CRITICAL POC
9.0 May 26

Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
CVE-2026-18922 CRITICAL
9.8 Sep 07

Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
CVE-2026-14544 CRITICAL
9.8 Jul 03

Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter

CVE-2026-76578 CRITICAL
9.8 Sep 07

Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
CVE-2026-5121 HIGH
7.5 Mar 30

Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe
CVE-2026-28369 CRITICAL
9.1 Mar 27

HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel

CVE-2026-28368 CRITICAL
9.1 Mar 27

HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls
CVE-2026-33845 CRITICAL
9.1 Apr 30

Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege
CVE-2026-28367 CRITICAL
9.1 Mar 27

HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator
CVE-2026-16526 HIGH
8.8 Jul 30

Local privilege escalation in Performance Co-Pilot (PCP) on Red Hat Enterprise Linux 6 through 10 and OpenShift Containe

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SLES15-SP5-CHOST-BYOS-SAP-CCloud Affected
SLES15-SP6-CHOST-BYOS Affected
SLES15-SP6-CHOST-BYOS-Aliyun Affected
SLES15-SP6-CHOST-BYOS-Azure Affected
SLES15-SP6-CHOST-BYOS-EC2 Affected

Share

CVE-2026-13595 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy