CVE-2026-13595: util-linux libblkid heap use-after-free in nested partition probing

CVE-2026-13595 · Severity: medium · CVSS 6.8 · Published 2026-06-29

A security flaw was found in a core Linux system library (libblkid) used to identify and probe disk partitions. When a computer detects a new disk—such as a USB drive or a virtual disk image—this library automatically scans it to understand its layout. An attacker can exploit this by providing a specially crafted disk image that causes the system to crash or potentially leak small amounts of sensitive memory information. Because this scanning process often happens automatically with high system privileges, the attack can be triggered simply by plugging in a malicious device.

Technologies: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4. Vendors: Red Hat.

Quick answers

Is CVE-2026-13595 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-13595 being exploited in the wild.
How severe is CVE-2026-13595?
Medium severity, with a CVSS score of 6.8, published 29 June 2026.
Which products and versions are affected?
util-linux util-linux All versions prior to commit c0186f1; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8; Red Hat Red Hat Enterprise Linux 9; and 2 more.
Is there a fix for CVE-2026-13595?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-13595 attacked?
It is attacked with local access or with physical access, in a software library.
Am I affected by CVE-2026-13595?
Check whether you run Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 or one of the others listed. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A heap use-after-free read exists in libblkid's nested partition probing logic (specifically in BSD, Minix, Solaris x86, and UnixWare probers). The vulnerability occurs because the library caches a raw pointer to a parent partition entry within a dynamically allocated array; when subsequent partition additions trigger a 'reallocarray()' call, the array is moved in memory, leaving the cached pointer dangling. An attacker can exploit this by presenting a crafted block device image (e.g., via USB or loop-mount) containing specific nested partition structures. Because libblkid is typically invoked automatically by udev/udisks as root during hot-plug events, the flaw can be triggered without user interaction. A fix has been committed to the upstream util-linux repository which changes the storage mechanism to an array of pointers to individually allocated partition structures, ensuring pointer stability.

Affected products

  • util-linux util-linux All versions prior to commit c0186f1
  • Red Hat Red Hat Enterprise Linux 7
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat OpenShift Container Platform 4

Timeline

  • 2026-06-29: disclosed: Vulnerability reported and CVE assigned
  • 2026-06-29: advisory: Red Hat and NVD published advisory details

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.