udisks2 EUVD-2026-54277

Exploitation requires all three of the following conditions: (1) a local user account with an active console session - the CVSS AV:L/PR:L vector confirms local low-privilege access as the entry point, and the polkit 'active session' check typically requires a graphical or physical console session rather than a background SSH connection; (2) at least one /etc/fstab entry carrying the 'user' or 'users' mount option for any filesystem - this is the specific prerequisite identified in the upstream release notes and is the configuration condition the exploit directly leverages to bypass polkit; (3) an unpatched udisks2 daemon running and accessible via D-Bus on the target system. Exploitation is limited or prevented on: headless servers with no 'user'/'users' fstab entries, minimal container or cloud instances where udisks2 is not installed, and systems where polkit rules explicitly deny 'as-user' for non-root callers. The requiring of an active console session (not merely any local account) meaningfully narrows the real-world attacker population compared to a raw PR:L reading.

The CVSS 3.1 score of 7.8 HIGH with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H is internally consistent and accurately reflects the attack profile: local access is required, privileges are low (any unprivileged account suffices), no user interaction is needed, and successful exploitation yields full CIA impact through effective root-level control via mount namespace manipulation. The unchanged scope (S:U) is defensible because the exploit acts on the same system; however, the mechanism of injecting content into another user's mount namespace blurs the scope boundary and may warrant re-evaluation by the scoring authority. No EPSS score was provided in the available data, so exploitation probability from that signal cannot be assessed. No CISA KEV listing is present, indicating no confirmed active exploitation at time of analysis. No public POC has been identified, though the detailed upstream release notes and public GitHub security advisory (GHSA-j42g-v9jw-6ph3) substantially lower the technical barrier for independent reproduction. The fstab 'user'/'users' prerequisite limits blast radius on minimal server deployments but is essentially a given on standard desktop Linux - making this a genuine and credible local privilege escalation priority wherever desktop Linux is deployed, rather than a theoretical high-CVSS-but-low-real-risk finding.

A low-privileged local user with an active console session on a standard Linux desktop opens a D-Bus connection to org.freedesktop.UDisks2 and calls Filesystem.Mount() with the 'as-user' parameter set to a privileged account such as root; because a USB drive or network share in /etc/fstab carries the 'users' option, the daemon skips the full polkit authorization check and mounts the filesystem into the privileged user's mount namespace. The attacker then plants a malicious binary or configuration file at a path that the privileged user's processes will traverse, achieving code execution or credential theft under the target account. No public exploit code has been identified at time of analysis, though the public security advisory and release notes provide sufficient technical detail for reproduction.