https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 10 Oct 2026 13:32:51 +0000 https://cve.radiocsirt.org/vuln/alsa-2025:9327 <p><strong>Affected:</strong> AlmaLinux:9: libblockdev, AlmaLinux:9: libblockdev-crypto, AlmaLinux:9: libblockdev-dm, AlmaLinux:9: libblockdev-fs, AlmaLinux:9: libblockdev-kbd, AlmaLinux:9: libblockdev-loop, AlmaLinux:9: libblockdev-lvm, AlmaLinux:9: libblockdev-lvm-dbus, AlmaLinux:9: libblockdev-mdraid, AlmaLinux:9: libblockdev-mpath and 9 more</p> <p>The libblockdev packages provide a C library with GObject introspection support used for low-level operations on block devices. The library serves as a thin wrapper around plug-ins for specific functionality, such as LVM, Btrfs, LUKS, or MD RAID.</p> <p>Security Fix(es):</p> <p>* libblockdev: LPE from allow_active to root in libblockdev via udisks (CVE-2025-6019)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> <p><strong>Affected:</strong> AlmaLinux:9: libblockdev, AlmaLinux:9: libblockdev-crypto, AlmaLinux:9: libblockdev-dm, AlmaLinux:9: libblockdev-fs, AlmaLinux:9: libblockdev-kbd, AlmaLinux:9: libblockdev-loop, AlmaLinux:9: libblockdev-lvm, AlmaLinux:9: libblockdev-lvm-dbus, AlmaLinux:9: libblockdev-mdraid, AlmaLinux:9: libblockdev-mpath and 9 more</p> <p>The libblockdev packages provide a C library with GObject introspection support used for low-level operations on block devices. The library serves as a thin wrapper around plug-ins for specific functionality, such as LVM, Btrfs, LUKS, or MD RAID.</p> <p>Security Fix(es):</p> <p>* libblockdev: LPE from allow_active to root in libblockdev via udisks (CVE-2025-6019)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> https://cve.radiocsirt.org/vuln/alsa-2025:9327 https://cve.radiocsirt.org/vuln/bdu:2025-07084 bdu:2025-07084 https://cve.radiocsirt.org/vuln/bdu:2025-07084 https://cve.radiocsirt.org/vuln/euvd-2026-331325 EUVD-2026-331325 https://cve.radiocsirt.org/vuln/euvd-2026-331325 https://cve.radiocsirt.org/vuln/fkie_cve-2025-6019 <p>A Local Privilege Escalation (LPE) vulnerability was found in libblockdev. Generally, the &#34;allow_active&#34; setting in Polkit permits a physically present user to take certain actions based on the session type. Due to the way libblockdev interacts with the udisks daemon, an &#34;allow_active&#34; user on a system may be able escalate to full root privileges on the target host. Normally, udisks mounts user-provided filesystem images with security flags like nosuid and nodev to prevent privilege escalation. However, a local attacker can create a specially crafted XFS image containing a SUID-root shell, then trick udisks into resizing it. This mounts their malicious filesystem with root privileges, allowing them to execute their SUID-root shell and gain complete control of the system.</p> <p>A Local Privilege Escalation (LPE) vulnerability was found in libblockdev. Generally, the &#34;allow_active&#34; setting in Polkit permits a physically present user to take certain actions based on the session type. Due to the way libblockdev interacts with the udisks daemon, an &#34;allow_active&#34; user on a system may be able escalate to full root privileges on the target host. Normally, udisks mounts user-provided filesystem images with security flags like nosuid and nodev to prevent privilege escalation. However, a local attacker can create a specially crafted XFS image containing a SUID-root shell, then trick udisks into resizing it. This mounts their malicious filesystem with root privileges, allowing them to execute their SUID-root shell and gain complete control of the system.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-6019 https://cve.radiocsirt.org/vuln/ghsa-mpgj-hch9-5rvx <p>A Local Privilege Escalation (LPE) vulnerability was found in libblockdev. Generally, the &#34;allow_active&#34; setting in Polkit permits a physically present user to take certain actions based on the session type. Due to the way libblockdev interacts with the udisks daemon, an &#34;allow_active&#34; user on a system may be able escalate to full root privileges on the target host. Normally, udisks mounts user-provided filesystem images with security flags like nosuid and nodev to prevent privilege escalation. However, a local attacker can create a specially crafted XFS image containing a SUID-root shell, then trick udisks into resizing it. This mounts their malicious filesystem with root privileges, allowing them to execute their SUID-root shell and gain complete control of the system.</p> <p>A Local Privilege Escalation (LPE) vulnerability was found in libblockdev. Generally, the &#34;allow_active&#34; setting in Polkit permits a physically present user to take certain actions based on the session type. Due to the way libblockdev interacts with the udisks daemon, an &#34;allow_active&#34; user on a system may be able escalate to full root privileges on the target host. Normally, udisks mounts user-provided filesystem images with security flags like nosuid and nodev to prevent privilege escalation. However, a local attacker can create a specially crafted XFS image containing a SUID-root shell, then trick udisks into resizing it. This mounts their malicious filesystem with root privileges, allowing them to execute their SUID-root shell and gain complete control of the system.</p> https://cve.radiocsirt.org/vuln/ghsa-mpgj-hch9-5rvx https://cve.radiocsirt.org/vuln/oesa-2025-1677 <p><strong>Affected:</strong> openEuler:22.03-LTS-SP4: libblockdev, openEuler:24.03-LTS: libblockdev, openEuler:24.03-LTS-SP1: libblockdev, openEuler:20.03-LTS-SP4: libblockdev, openEuler:22.03-LTS-SP3: libblockdev</p> <p>libblockdev is a C library supporting GObject introspection for manipulation of block devices. It has a plugin-based architecture where each technology (like LVM, Btrfs, MD RAID, Swap,...) is implemented in a separate plugin, possibly with multiple implementations (e.g. using LVM CLI or the new LVM DBus API). Security Fix(es):</p> <p>A Local Privilege Escalation (LPE) vulnerability was found in libblockdev. Generally, the &amp;quot;allow_active&amp;quot; setting in Polkit permits a physically present user to take certain actions based on the session type. Due to the way libblockdev interacts with the udisks daemon, an &amp;quot;allow_active&amp;quot; user on a system may be able escalate to full root privileges on the target host. Normally, udisks mounts user-provided filesystem images with security flags like nosuid and nodev to prevent privilege escalation. However, a local attacker can create a specially crafted XFS image containing a SUID-root shell, then trick udisks into resizing it. This mounts their malicious filesystem with root privileges, allowing them to execute their SUID-root shell and gain complete control of the system.(CVE-2025-6019)</p> <p><strong>Affected:</strong> openEuler:22.03-LTS-SP4: libblockdev, openEuler:24.03-LTS: libblockdev, openEuler:24.03-LTS-SP1: libblockdev, openEuler:20.03-LTS-SP4: libblockdev, openEuler:22.03-LTS-SP3: libblockdev</p> <p>libblockdev is a C library supporting GObject introspection for manipulation of block devices. It has a plugin-based architecture where each technology (like LVM, Btrfs, MD RAID, Swap,...) is implemented in a separate plugin, possibly with multiple implementations (e.g. using LVM CLI or the new LVM DBus API). Security Fix(es):</p> <p>A Local Privilege Escalation (LPE) vulnerability was found in libblockdev. Generally, the &amp;quot;allow_active&amp;quot; setting in Polkit permits a physically present user to take certain actions based on the session type. Due to the way libblockdev interacts with the udisks daemon, an &amp;quot;allow_active&amp;quot; user on a system may be able escalate to full root privileges on the target host. Normally, udisks mounts user-provided filesystem images with security flags like nosuid and nodev to prevent privilege escalation. However, a local attacker can create a specially crafted XFS image containing a SUID-root shell, then trick udisks into resizing it. This mounts their malicious filesystem with root privileges, allowing them to execute their SUID-root shell and gain complete control of the system.(CVE-2025-6019)</p> https://cve.radiocsirt.org/vuln/oesa-2025-1677 https://cve.radiocsirt.org/vuln/opensuse-su-2025:15237-1 <p>libbd_btrfs-devel-3.1.1-2.1 on GA media</p> <p>libbd_btrfs-devel-3.1.1-2.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2025:15237-1 https://cve.radiocsirt.org/vuln/rhsa-2025:9320 <p>libblockdev: LPE from allow_active to root in libblockdev via udisks</p> <p>libblockdev: LPE from allow_active to root in libblockdev via udisks</p> https://cve.radiocsirt.org/vuln/rhsa-2025:9320 https://cve.radiocsirt.org/vuln/suse-su-2025:02043-1 <p>Security update for libblockdev</p> <p>Security update for libblockdev</p> https://cve.radiocsirt.org/vuln/suse-su-2025:02043-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-6019 <p><strong>Affected:</strong> Ubuntu:Pro:18.04:LTS: libblockdev, Ubuntu:Pro:18.04:LTS: udisks2, Ubuntu:Pro:20.04:LTS: libblockdev, Ubuntu:Pro:20.04:LTS: udisks2, Ubuntu:22.04:LTS: libblockdev, Ubuntu:22.04:LTS: udisks2, Ubuntu:24.04:LTS: libblockdev, Ubuntu:24.04:LTS: udisks2, Ubuntu:25.10: udisks2</p> <p>A Local Privilege Escalation (LPE) vulnerability was found in libblockdev. Generally, the &#34;allow_active&#34; setting in Polkit permits a physically present user to take certain actions based on the session type. Due to the way libblockdev interacts with the udisks daemon, an &#34;allow_active&#34; user on a system may be able escalate to full root privileges on the target host. Normally, udisks mounts user-provided filesystem images with security flags like nosuid and nodev to prevent privilege escalation. However, a local attacker can create a specially crafted XFS image containing a SUID-root shell, then trick udisks into resizing it. This mounts their malicious filesystem with root privileges, allowing them to execute their SUID-root shell and gain complete control of the system.</p> <p><strong>Affected:</strong> Ubuntu:Pro:18.04:LTS: libblockdev, Ubuntu:Pro:18.04:LTS: udisks2, Ubuntu:Pro:20.04:LTS: libblockdev, Ubuntu:Pro:20.04:LTS: udisks2, Ubuntu:22.04:LTS: libblockdev, Ubuntu:22.04:LTS: udisks2, Ubuntu:24.04:LTS: libblockdev, Ubuntu:24.04:LTS: udisks2, Ubuntu:25.10: udisks2</p> <p>A Local Privilege Escalation (LPE) vulnerability was found in libblockdev. Generally, the &#34;allow_active&#34; setting in Polkit permits a physically present user to take certain actions based on the session type. Due to the way libblockdev interacts with the udisks daemon, an &#34;allow_active&#34; user on a system may be able escalate to full root privileges on the target host. Normally, udisks mounts user-provided filesystem images with security flags like nosuid and nodev to prevent privilege escalation. However, a local attacker can create a specially crafted XFS image containing a SUID-root shell, then trick udisks into resizing it. This mounts their malicious filesystem with root privileges, allowing them to execute their SUID-root shell and gain complete control of the system.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-6019 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-1354 <p>Ein lokaler Angreifer kann mehrere Schwachstellen in verschiedenen Linux Distributionen ausnutzen, um seine Privilegien zu erhöhen.</p> <p>Ein lokaler Angreifer kann mehrere Schwachstellen in verschiedenen Linux Distributionen ausnutzen, um seine Privilegien zu erhöhen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2025-1354