Skip to content
Fencer Vulns
medium 6.8

CVE-2026-13595 json

Util-linux: util-linux: heap use-after-free in libblkid nested partition probing

published 2026-06-29 4 mo ago modified 2026-11-09 2 h ago also EUVD-2026-40053 , JLSEC-2026-1263

cvss
6.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.1%
EPSS 0.1% chance of exploitation in 30 days, percentile 3%
public exploits
0
none known

Summary

A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.

Patch / fix

  • Red Hat Red Hat Enterprise Linux 10 0:2.40.2-18.el10_2.20
  • Red Hat Red Hat Enterprise Linux 8 0:2.32.1-50.el8_10
  • Red Hat Red Hat Cost Management On-Premise 1 1793825318
  • Red Hat Red Hat Hardened Images 2.42.2-1.hum1
  • util-linux Debian 13 2.41.5-0+deb13u1
  • util-linux Debian 14 2.42.2-1

debian advisories DEBIAN-CVE-2026-13595

  • util-linux Ubuntu 22.04 LTS 2.37.2-4ubuntu3.6
  • util-linux Ubuntu 24.04 LTS 2.39.3-9ubuntu6.6
  • util-linux Ubuntu 26.04 LTS 2.41.3-3ubuntu2.2

ubuntu advisories UBUNTU-CVE-2026-13595

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • uuidd hummingbird 1 2.42.2-1.hum1
  • libuuid hummingbird 1 2.42.2-1.hum1
  • libblkid hummingbird 1 2.42.2-1.hum1
  • libfdisk hummingbird 1 2.42.2-1.hum1
  • libmount hummingbird 1 2.42.2-1.hum1
  • util-linux hummingbird 1 2.42.2-1.hum1
  • liblastlog2 hummingbird 1 2.42.2-1.hum1
  • libsmartcols hummingbird 1 2.42.2-1.hum1

red hat advisories RHSA-2026:26573

  • util-linux SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 2.41.1-160000.5.1
  • python-libmount SLES 16.0, SLES for SAP applications 16.0 2.41.1-160000.5.1
  • util-linux-systemd SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 2.41.1-160000.5.1
  • util-linux SLES for SAP 15 SP5, SLES 15 SP5-LTSS, SLE Micro 5.5 +2 more 2.37.4-150500.9.32.1
  • util-linux-systemd SLES for SAP 15 SP5, SLES 15 SP5-LTSS, SLE Micro 5.5 +2 more 2.37.4-150500.9.32.1
  • util-linux SLES for SAP 15 SP4, SLES 15 SP4-LTSS, SLE Micro 5.4 +3 more 2.37.2-150400.8.50.1
  • util-linux-systemd SLES for SAP 15 SP4, SLES 15 SP4-LTSS, SLE Micro 5.4 +3 more 2.37.2-150400.8.50.1
  • util-linux Linux Micro 6.1 2.40.4-slfo.1.1_7.1

suse advisories SUSE-SU-2026:4296-1SUSE-SU-2026:23861-1SUSE-SU-2026:23870-1SUSE-SU-2026:23884-1SUSE-SU-2026:3813-1SUSE-SU-2026:3812-1

  • util-linux openSUSE Leap 16.0 2.41.1-160000.5.1
  • python-libmount openSUSE Leap 16.0 2.41.1-160000.5.1
  • util-linux-systemd openSUSE Leap 16.0 2.41.1-160000.5.1
  • util-linux openSUSE Tumbleweed 2.42.2-1.1

opensuse advisories openSUSE-SU-2026:21905-1openSUSE-SU-2026:11408-1

  • util-linux AlmaLinux 10 2.40.2-18.el10_2.20
  • uuidd AlmaLinux 10 2.40.2-18.el10_2.20
  • libuuid AlmaLinux 10 2.40.2-18.el10_2.20
  • libblkid AlmaLinux 10 2.40.2-18.el10_2.20
  • libfdisk AlmaLinux 10 2.40.2-18.el10_2.20
  • libmount AlmaLinux 10 2.40.2-18.el10_2.20
  • libsmartcols AlmaLinux 10 2.40.2-18.el10_2.20
  • util-linux-core AlmaLinux 10 2.40.2-18.el10_2.20

almalinux advisories ALSA-2026:93461

  • util-linux Rocky Linux 10 2.40.2-18.el10_2.20

rocky linux advisories RLSA-2026:93461

  • util-linux Azure Linux 3.0 2.40.2-5

azure linux advisories AZL-91581

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-13595 updated cvss 6.8

util-linux: util-linux: heap use-after-free in libblkid nested partition probing

  • Red Hat Enterprise Linux 7 uuidd, libuuid, libblkid, libmount, util-linux Red Hat Enterprise Linux 9 uuidd, libuuid, libblkid, libfdisk, libmount, util-linux, +4 more Red Hat OpenShift Container Platform 4 openshift/ose-rhel-coreos-8, openshift/ose-rhel-coreos-9 Red Hat OpenShift Container Platform 5 openshift/ose-rhel-coreos-9
    affected: workaround, no fix available “Fix deferred”
  • Red Hat OpenShift AI (RHOAI) rhoai/odh-core-bff-rhel9, rhoai/odh-dashboard-rhel9, rhoai/odh-mod-arch-maas-rhel9, rhoai/odh-mod-arch-automl-rhel9, rhoai/odh-mod-arch-gen-ai-rhel9, rhoai/odh-mod-arch-mlflow-rhel9, +6 more
    under investigation
  • Red Hat Cost Management On-Premise 1 costmanagement/costmanagement-ui-rhel10 1793825318
    fixed: vendor fix RHSA-2026:95365
  • Red Hat Enterprise Linux AppStream (v. 8) python3-libmount 2.32.1-50.el8_10
    fixed: vendor fix RHSA-2026:96212
  • Red Hat Enterprise Linux AppStream (v. 10) uuidd 2.40.2-18.el10_2.20, python3-libmount 2.40.2-18.el10_2.20
    fixed: vendor fix RHSA-2026:93461
  • Red Hat Enterprise Linux BaseOS (v. 8) uuidd 2.32.1-50.el8_10, libuuid 2.32.1-50.el8_10, libblkid 2.32.1-50.el8_10, libfdisk 2.32.1-50.el8_10, libmount 2.32.1-50.el8_10, util-linux 2.32.1-50.el8_10, +2 more
    fixed: vendor fix RHSA-2026:96212
  • Red Hat Enterprise Linux BaseOS (v. 10) libuuid 2.40.2-18.el10_2.20, libblkid 2.40.2-18.el10_2.20, libfdisk 2.40.2-18.el10_2.20, libmount 2.40.2-18.el10_2.20, util-linux 2.40.2-18.el10_2.20, libsmartcols 2.40.2-18.el10_2.20, +1 more Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) libfdisk-devel 2.40.2-18.el10_2.20, uuidd-debuginfo 2.40.2-18.el10_2.20, libuuid-debuginfo 2.40.2-18.el10_2.20, libblkid-debuginfo 2.40.2-18.el10_2.20, libfdisk-debuginfo 2.40.2-18.el10_2.20, libmount-debuginfo 2.40.2-18.el10_2.20, +6 more
    fixed: vendor fix RHSA-2026:93461
  • Red Hat Enterprise Linux CRB (v. 8) libmount-devel 2.32.1-50.el8_10, uuidd-debuginfo 2.32.1-50.el8_10, libuuid-debuginfo 2.32.1-50.el8_10, libblkid-debuginfo 2.32.1-50.el8_10, libfdisk-debuginfo 2.32.1-50.el8_10, libmount-debuginfo 2.32.1-50.el8_10, +5 more
    fixed: vendor fix RHSA-2026:96212
show 2 more
  • Red Hat Hardened Images uuidd 2.42.2-1.hum1, libuuid 2.42.2-1.hum1, libblkid 2.42.2-1.hum1, libfdisk 2.42.2-1.hum1, libmount 2.42.2-1.hum1, util-linux 2.42.2-1.hum1, +6 more
    fixed: vendor fix RHSA-2026:26573
  • Red Hat OpenShift AI (RHOAI) rhoai/odh-mlflow-rhel9, rhoai/odh-kube-rbac-proxy-rhel9, rhoai/odh-maas-controller-rhel9, rhoai/odh-mlflow-operator-rhel9, rhoai/odh-model-controller-rhel9, rhoai/odh-ogx-k8s-operator-rhel9, +14 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
4 mo ago

Exploit prediction

0.14% chance of exploitation in the next 30 days, higher than 3% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 6.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
NVD 3.1 5.3 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H
OSV 3.1 5.3 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H

Affected packages

ecosystem package affected fixed in
julia Libmount_jll
all versions
 no fix listed
julia util_linux_jll
all versions
 no fix listed

Affected products

  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Cost Management On-Premise 1
  • Red Hat Red Hat Hardened Images
  • Red Hat Red Hat Enterprise Linux 7
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat OpenShift AI (RHOAI)
  • Red Hat Red Hat OpenShift Container Platform 4
  • Red Hat Red Hat OpenShift Container Platform 5

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.