Executive brief
A security flaw was found in a core Linux system library (libblkid) used to identify and probe disk partitions. When a computer detects a new disk—such as a USB drive or a virtual disk image—this library automatically scans it to understand its layout. An attacker can exploit this by providing a specially crafted disk image that causes the system to crash or potentially leak small amounts of sensitive memory information. Because this scanning process often happens automatically with high system privileges, the attack can be triggered simply by plugging in a malicious device.
Technical details
A heap use-after-free read exists in libblkid's nested partition probing logic (specifically in BSD, Minix, Solaris x86, and UnixWare probers). The vulnerability occurs because the library caches a raw pointer to a parent partition entry within a dynamically allocated array; when subsequent partition additions trigger a 'reallocarray()' call, the array is moved in memory, leaving the cached pointer dangling. An attacker can exploit this by presenting a crafted block device image (e.g., via USB or loop-mount) containing specific nested partition structures. Because libblkid is typically invoked automatically by udev/udisks as root during hot-plug events, the flaw can be triggered without user interaction. A fix has been committed to the upstream util-linux repository which changes the storage mechanism to an array of pointers to individually allocated partition structures, ensuring pointer stability.
Affected products
- util-linux util-linux All versions prior to commit c0186f1
- Red Hat Red Hat Enterprise Linux 7
- Red Hat Red Hat Enterprise Linux 8
- Red Hat Red Hat Enterprise Linux 9
- Red Hat Red Hat Enterprise Linux 10
- Red Hat Red Hat OpenShift Container Platform 4
Timeline
- 2026-06-29: disclosed: Vulnerability reported and CVE assigned
- 2026-06-29: advisory: Red Hat and NVD published advisory details