# CVE-2026-53615: util-linux integer overflow in DOS partition parsing

Source: https://junglewise.ai/threats/cve-2026-53615-util-linux-is-a-random-collection-of-linux-utilities-before-util  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-14. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-53615 · Severity: high · CVSS 8 · Published 2026-10-14

util-linux is a collection of essential Linux system utilities including disk partitioning tools. A flaw in the libblkid library's DOS partition parser allows a local attacker to cause false partition metadata to be reported when processing a specially crafted disk image or removable medium. While the integrity of reported partition information is compromised, actual disk modification or availability loss would require a separate application to act on the false metadata.

Technologies: [Util-Linux](https://junglewise.ai/threats/technologies/util-linux-util-linux). Vendors: [Util-Linux](https://junglewise.ai/threats/vendors/util-linux).

## Quick answers

**Is CVE-2026-53615 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-53615 being exploited in the wild.

**How severe is CVE-2026-53615?** High severity, with a CVSS score of 8, published 14 October 2026.

**Which products and versions are affected?** Util-Linux before 2.41.4.

**Is there a fix for CVE-2026-53615?** Yes: fixed in 2.41.4. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-53615 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-53615?** Check whether you run Util-Linux at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 2.41.4

## Technical details

The parse_dos_extended() function in libblkid/src/partitions/dos.c uses 32-bit integer addition to compute absolute partition start sectors, allowing overflow when crafted values wrap to sector zero. Additionally, extended partition bounds checks are not applied to the first two EBR (Extended Boot Record) entries, unlike later entries. An attacker with local access to cause a crafted disk image to be probed via libblkid can trigger these conditions to report false partition overlays; downstream applications consuming this metadata could be affected.

## Affected products

- util-linux util-linux before 2.41.4

## Timeline

- 2026-10-14: disclosed
- 2026-10-14: patched: Fix applied via commit 05c2dba and a2d8581

## References

- [https://github.com/util-linux/util-linux/commit/05c2dbadf34cc74192287f377904afaaf4061623](https://github.com/util-linux/util-linux/commit/05c2dbadf34cc74192287f377904afaaf4061623)
- [https://github.com/util-linux/util-linux/commit/a2d858176b609ab5b8535021a3af9cd302d23d31](https://github.com/util-linux/util-linux/commit/a2d858176b609ab5b8535021a3af9cd302d23d31)

## Related threats

- [util-linux mount SUID privilege escalation via LIBMOUNT_FORCE_MOUNT2](https://junglewise.ai/threats/cve-2026-53614-util-linux-is-a-random-collection-of-linux-utilities-in-util)
- [util-linux mount TOCTOU privilege escalation via renameat2](https://junglewise.ai/threats/cve-2026-53613-util-linux-is-a-random-collection-of-linux-utilities-in-util)