Local Privilege Escalation Vulnerability in util-linux by The Util-linux Project

CVE-2026-53615

What is CVE-2026-53615?

The util-linux utility suite contains a collection of essential tools for Linux environments. A vulnerability exists in the parse_dos_extended() function within the libblkid/src/partitions/dos.c file, where extended-partition start sectors are computed using 32-bit addition without proper bounds checks on the initial two Extended Boot Records (EBRs). This flaw allows a local attacker to craft a malicious DOS extended-partition disk image that, when probed, can result in a wrap-around of the start sector to zero. Consequently, the libblkid library may report inaccurate partition metadata, potentially leading to issues like disk modification or loss of data availability when dependent applications act on the erroneous metadata. The vulnerability has been addressed in util-linux version 2.41.4.

References