util-linux EUVD-2026-101292

Requires a local attacker to supply a crafted DOS (MBR) extended-partition disk image or removable medium and have the host probe it with libblkid - e.g. automatic inspection on USB insertion via udev/udisks, or a tool/VM/forensic pipeline that scans attacker-provided images. The EBR entries must be constructed so the 32-bit cur_start + start addition wraps to sector zero. LIMITING FACTORS: not remotely exploitable (AV:L); the attacker needs physical or filesystem-level delivery of the malicious medium plus a probing path; and real disk-modification or availability impact is NOT direct - it requires a separate downstream consumer to trust and act on the falsified partition metadata. Only util-linux versions before 2.41.4 are affected; 2.41.4 adds 64-bit arithmetic and extended-area bounds checks.

Signals are internally consistent but modest in real-world terms. The official CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N, base 8.0) correctly reflects a LOCAL attack vector - the description confirms exploitation requires a crafted DOS extended-partition disk image or removable medium to be probed on the target host, so this is not remotely exploitable despite PR:N. The high 8.0 score is driven almost entirely by the I:H/A:H impact metrics, yet the description itself explicitly scopes the DIRECT impact to integrity of reported partition metadata and states that 'disk modification or availability loss requires a separate downstream consumer to act on that metadata.' This is a meaningful conflict: the base score counts conditional downstream consequences as if they were direct, inflating perceived severity. No EPSS score, CISA KEV listing, POC, or SSVC decision data was provided in the input, so exploitation probability and automatability cannot be quantified. There is no public exploit identified at time of analysis - the GitHub links are the vendor fix commits and advisory, not weaponized exploit code. Net: this is a genuine integrity defect in a ubiquitous library and worth patching, but in isolation it is a high-CVSS / lower-real-risk issue - it requires local attacker-controlled media plus a downstream consumer that acts on the false metadata to cause actual disk or availability harm, rather than being an internet-facing or self-propagating threat.

A local attacker crafts a DOS extended-partition disk image or USB/removable medium with EBR entries engineered so the 32-bit addition cur_start + start wraps to sector zero, then gets it probed - e.g. via auto-inspection on USB insertion (udev/udisks) or a VM/forensic tool scanning an uploaded image. libblkid then reports a false partition overlapping the MBR; if a downstream tool trusts that metadata and writes to it, disk corruption or data loss can follow. No public exploit code is identified at time of analysis.