Skip to content
Fencer Vulns
high 7.0

CVE-2025-6019 json

Libblockdev: lpe from allow_active to root in libblockdev via udisks

published 2025-06-19 16 mo ago modified 2026-06-30 4 mo ago also EUVD-2025-18685

cvss
7.0
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 41%
public exploits
0
none known

Summary

A Local Privilege Escalation (LPE) vulnerability was found in libblockdev. Generally, the "allow_active" setting in Polkit permits a physically present user to take certain actions based on the session type. Due to the way libblockdev interacts with the udisks daemon, an "allow_active" user on a system may be able escalate to full root privileges on the target host. Normally, udisks mounts user-provided filesystem images with security flags like nosuid and nodev to prevent privilege escalation. However, a local attacker can create a specially crafted XFS image containing a SUID-root shell, then trick udisks into resizing it. This mounts their malicious filesystem with root privileges, allowing them to execute their SUID-root shell and gain complete control of the system.

Patch / fix

  • Red Hat Red Hat Enterprise Linux 10 0:3.2.0-4.el10_0
  • Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support 0:2.18-5.el7_9.1
  • Red Hat Red Hat Enterprise Linux 8 0:2.28-7.el8_10
  • Red Hat Red Hat Enterprise Linux 8.2 Advanced Update Support 0:2.19-13.el8_2
  • Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support 0:2.24-6.el8_4
  • Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support 0:2.24-9.el8_6
  • Red Hat Red Hat Enterprise Linux 8.6 Telecommunications Update Service 0:2.24-9.el8_6
  • Red Hat Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions 0:2.24-9.el8_6
  • Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions 0:2.28-3.el8_8
  • Red Hat Red Hat Enterprise Linux 9 0:2.28-14.el9_6
  • Red Hat Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions 0:2.25-12.el9_0
  • Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions 0:2.28-5.el9_2
  • Red Hat Red Hat Enterprise Linux 9.4 Extended Update Support 0:2.28-11.el9_4
  • libblockdev Debian 12 2.28-2+deb12u1
  • libblockdev Debian 14, Debian 13 3.3.0-2.1

debian advisories DEBIAN-CVE-2025-6019

  • udisks2 Ubuntu 22.04 LTS 2.9.4-1ubuntu2.2
  • udisks2 Ubuntu 24.04 LTS 2.10.1-6ubuntu1.2
  • udisks2 Ubuntu 25.10 2.10.1-12.1ubuntu1
  • libblockdev Ubuntu 22.04 LTS 2.26-1ubuntu0.1
  • libblockdev Ubuntu 24.04 LTS 3.1.1-1ubuntu0.1
  • udisks2 Ubuntu Pro 18.04 LTS 2.7.6-3ubuntu0.2+esm1
  • udisks2 Ubuntu Pro 20.04 LTS 2.8.4-1ubuntu2+esm1
  • libblockdev Ubuntu Pro 18.04 LTS 2.16-2ubuntu0.1~esm1

ubuntu advisories UBUNTU-CVE-2025-6019

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • libblockdev RHEL 8 2.28-7.el8_10
  • libblockdev-dm RHEL 8 2.28-7.el8_10
  • libblockdev-fs RHEL 8 2.28-7.el8_10
  • libblockdev-kbd RHEL 8 2.28-7.el8_10
  • libblockdev-lvm RHEL 8 2.28-7.el8_10
  • libblockdev-vdo RHEL 8 2.28-7.el8_10
  • libblockdev-loop RHEL 8 2.28-7.el8_10
  • libblockdev-part RHEL 8 2.28-7.el8_10

red hat advisories RHSA-2025:10796RHSA-2025:9878RHSA-2025:9328RHSA-2025:9327RHSA-2025:9326RHSA-2025:9324

  • libblockdev SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES 15 SP5-LTSS +15 more 2.26-150400.3.5.1
  • libblockdev SLES for SAP 15 SP3, SLES 15 SP3-LTSS, SLE High Performance Computing 15 SP3-LTSS +1 more 2.22-150200.3.3.1
  • libblockdev Linux Micro 6.0 2.28-2.1
  • libblockdev Linux Micro 6.1 2.28-slfo.1.1_2.1

suse advisories SUSE-SU-2025:02044-1SUSE-SU-2025:02043-1SUSE-SU-2025:20426-1SUSE-SU-2025:20440-1

  • libblockdev openSUSE Tumbleweed 3.1.1-2.1

opensuse advisories openSUSE-SU-2025:15237-1

  • libblockdev AlmaLinux 8 2.28-7.el8_10
  • libblockdev-dm AlmaLinux 8 2.28-7.el8_10
  • libblockdev-fs AlmaLinux 8 2.28-7.el8_10
  • libblockdev-kbd AlmaLinux 8 2.28-7.el8_10
  • libblockdev-lvm AlmaLinux 8 2.28-7.el8_10
  • libblockdev-vdo AlmaLinux 8 2.28-7.el8_10
  • libblockdev-loop AlmaLinux 8 2.28-7.el8_10
  • libblockdev-part AlmaLinux 8 2.28-7.el8_10

almalinux advisories ALSA-2025:9878ALSA-2025:9327ALSA-2025:9328ALSA-2025:A004ALSA-2025:A005ALSA-2025:A006

  • libblockdev Rocky Linux 9 2.28-14.el9_6
  • libblockdev Rocky Linux 10 3.2.0-4.el10_0
  • libblockdev Rocky Linux 8 2.28-7.el8_10

rocky linux advisories RLSA-2025:9327RLSA-2025:9328RLSA-2025:9878

  • libblockdev Arch Linux 3.3.1-1

arch linux advisories AVG-2905

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-6019 updated cvss 7.0

libblockdev: LPE from allow_active to root in libblockdev via udisks

  • Red Hat Enterprise Linux AppStream (v. 8) libblockdev 2.28-7.el8_10, libblockdev-dm 2.28-7.el8_10, libblockdev-fs 2.28-7.el8_10, libblockdev-kbd 2.28-7.el8_10, libblockdev-lvm 2.28-7.el8_10, libblockdev-vdo 2.28-7.el8_10, +12 more
    fixed: vendor fix “Currently, no mitigation is available for this vulnerability.” RHSA-2025:9878
  • Red Hat Enterprise Linux AppStream (v. 9) libblockdev 2.28-14.el9_6, libblockdev-dm 2.28-14.el9_6, libblockdev-fs 2.28-14.el9_6, libblockdev-kbd 2.28-14.el9_6, libblockdev-lvm 2.28-14.el9_6, libblockdev-loop 2.28-14.el9_6, +13 more
    fixed: vendor fix “Currently, no mitigation is available for this vulnerability.” RHSA-2025:9327
  • Red Hat Enterprise Linux AppStream (v. 10) libblockdev 3.2.0-4.el10_0, libblockdev-dm 3.2.0-4.el10_0, libblockdev-fs 3.2.0-4.el10_0, libblockdev-lvm 3.2.0-4.el10_0, libblockdev-loop 3.2.0-4.el10_0, libblockdev-nvme 3.2.0-4.el10_0, +14 more
    fixed: vendor fix “Currently, no mitigation is available for this vulnerability.” RHSA-2025:9328
  • Red Hat Enterprise Linux AppStream AUS (v. 8.2) libblockdev 2.19-13.el8_2, libblockdev-dm 2.19-13.el8_2, libblockdev-fs 2.19-13.el8_2, libblockdev-kbd 2.19-13.el8_2, libblockdev-lvm 2.19-13.el8_2, libblockdev-vdo 2.19-13.el8_2, +11 more
    fixed: vendor fix “Currently, no mitigation is available for this vulnerability.” RHSA-2025:9320
  • Red Hat Enterprise Linux AppStream AUS (v.8.4) libblockdev 2.24-6.el8_4, libblockdev-dm 2.24-6.el8_4, libblockdev-fs 2.24-6.el8_4, libblockdev-kbd 2.24-6.el8_4, libblockdev-lvm 2.24-6.el8_4, libblockdev-vdo 2.24-6.el8_4, +11 more
    fixed: vendor fix “Currently, no mitigation is available for this vulnerability.” RHSA-2025:9321
  • Red Hat Enterprise Linux AppStream AUS (v.8.6) libblockdev 2.24-9.el8_6, libblockdev-dm 2.24-9.el8_6, libblockdev-fs 2.24-9.el8_6, libblockdev-kbd 2.24-9.el8_6, libblockdev-lvm 2.24-9.el8_6, libblockdev-vdo 2.24-9.el8_6, +11 more Red Hat Enterprise Linux AppStream E4S (v.8.6) libblockdev 2.24-9.el8_6, libblockdev-dm 2.24-9.el8_6, libblockdev-fs 2.24-9.el8_6, libblockdev-kbd 2.24-9.el8_6, libblockdev-lvm 2.24-9.el8_6, libblockdev-vdo 2.24-9.el8_6, +12 more
    fixed: vendor fix “Currently, no mitigation is available for this vulnerability.” RHSA-2025:9322
  • Red Hat Enterprise Linux AppStream E4S (v.8.8) libblockdev 2.28-3.el8_8, libblockdev-dm 2.28-3.el8_8, libblockdev-fs 2.28-3.el8_8, libblockdev-kbd 2.28-3.el8_8, libblockdev-lvm 2.28-3.el8_8, libblockdev-vdo 2.28-3.el8_8, +11 more
    fixed: vendor fix “Currently, no mitigation is available for this vulnerability.” RHSA-2025:9323
  • Red Hat Enterprise Linux AppStream E4S (v.9.0) libblockdev 2.25-12.el9_0, libblockdev-dm 2.25-12.el9_0, libblockdev-fs 2.25-12.el9_0, libblockdev-kbd 2.25-12.el9_0, libblockdev-lvm 2.25-12.el9_0, libblockdev-loop 2.25-12.el9_0, +12 more
    fixed: vendor fix “Currently, no mitigation is available for this vulnerability.” RHSA-2025:9324
show 5 more
  • Red Hat Enterprise Linux AppStream E4S (v.9.2) libblockdev 2.28-5.el9_2, libblockdev-dm 2.28-5.el9_2, libblockdev-fs 2.28-5.el9_2, libblockdev-kbd 2.28-5.el9_2, libblockdev-lvm 2.28-5.el9_2, libblockdev-loop 2.28-5.el9_2, +13 more
    fixed: vendor fix “Currently, no mitigation is available for this vulnerability.” RHSA-2025:9325
  • Red Hat Enterprise Linux AppStream EUS (v.9.4) libblockdev 2.28-11.el9_4, libblockdev-dm 2.28-11.el9_4, libblockdev-fs 2.28-11.el9_4, libblockdev-kbd 2.28-11.el9_4, libblockdev-lvm 2.28-11.el9_4, libblockdev-loop 2.28-11.el9_4, +13 more
    fixed: vendor fix “Currently, no mitigation is available for this vulnerability.” RHSA-2025:9326
  • Red Hat Enterprise Linux AppStream TUS (v.8.6) libblockdev 2.24-9.el8_6, libblockdev-dm 2.24-9.el8_6, libblockdev-fs 2.24-9.el8_6, libblockdev-kbd 2.24-9.el8_6, libblockdev-lvm 2.24-9.el8_6, libblockdev-vdo 2.24-9.el8_6, +11 more
    fixed: vendor fix “Currently, no mitigation is available for this vulnerability.” RHSA-2025:9322
  • Red Hat Enterprise Linux CRB (v. 8) libblockdev-devel 2.28-7.el8_10, libblockdev-fs-devel 2.28-7.el8_10, libblockdev-debuginfo 2.28-7.el8_10, libblockdev-lvm-devel 2.28-7.el8_10, libblockdev-vdo-devel 2.28-7.el8_10, libblockdev-loop-devel 2.28-7.el8_10, +22 more
    fixed: vendor fix “Currently, no mitigation is available for this vulnerability.” RHSA-2025:9878
  • Red Hat Enterprise Linux Server (v. 7 ELS) libblockdev 2.18-5.el7_9.1, libblockdev-fs 2.18-5.el7_9.1, libblockdev-lvm 2.18-5.el7_9.1, libblockdev-loop 2.18-5.el7_9.1, libblockdev-part 2.18-5.el7_9.1, libblockdev-swap 2.18-5.el7_9.1, +5 more Red Hat Enterprise Linux Server Optional (v. 7 ELS) libblockdev-dm 2.18-5.el7_9.1, libblockdev-kbd 2.18-5.el7_9.1, libblockdev-vdo 2.18-5.el7_9.1, libblockdev-s390 2.18-5.el7_9.1, libblockdev-btrfs 2.18-5.el7_9.1, libblockdev-mpath 2.18-5.el7_9.1, +2 more
    fixed: vendor fix “Currently, no mitigation is available for this vulnerability.” RHSA-2025:10796

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
16 mo ago

Exploit prediction

0.48% chance of exploitation in the next 30 days, higher than 41% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 8.2 Advanced Update Support
  • Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  • Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  • Red Hat Red Hat Enterprise Linux 8.6 Telecommunications Update Service
  • Red Hat Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9.4 Extended Update Support

Classification

Weakness
  • CWE-250 Execution with Unnecessary Privileges

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.