CVE-2025-6019Libblockdev: lpe from allow_active to root in libblockdev via udisks

Description

A Local Privilege Escalation (LPE) vulnerability was found in libblockdev. Generally, the "allow_active" setting in Polkit permits a physically present user to take certain actions based on the session type. Due to the way libblockdev interacts with the udisks daemon, an "allow_active" user on a system may be able escalate to full root privileges on the target host. Normally, udisks mounts user-provided filesystem images with security flags like nosuid and nodev to prevent privilege escalation. However, a local attacker can create a specially crafted XFS image containing a SUID-root shell, then trick udisks into resizing it. This mounts their malicious filesystem with root privileges, allowing them to execute their SUID-root shell and gain complete control of the system.

Timeline

Scores

EPSS (exploitation in 30 days)

0.48% · top 58% of all CVEs (14 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.0.

Affected products

• libblockdev

  • affected < 3.3.1

• Red Hat · Red Hat Enterprise Linux 10

  • unaffected 0:3.2.0-4.el10_0 – < *

• Red Hat · Red Hat Enterprise Linux 7 Extended Lifecycle Support

  • unaffected 0:2.18-5.el7_9.1 – < *

• Red Hat · Red Hat Enterprise Linux 8

  • unaffected 0:2.28-7.el8_10 – < *

• Red Hat · Red Hat Enterprise Linux 8.2 Advanced Update Support

  • unaffected 0:2.19-13.el8_2 – < *

• Red Hat · Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support

  • unaffected 0:2.24-6.el8_4 – < *

• Red Hat · Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support

  • unaffected 0:2.24-9.el8_6 – < *

• Red Hat · Red Hat Enterprise Linux 8.6 Telecommunications Update Service

  • unaffected 0:2.24-9.el8_6 – < *

• Red Hat · Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions

  • unaffected 0:2.24-9.el8_6 – < *

• Red Hat · Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions

  • unaffected 0:2.28-3.el8_8 – < *

• Red Hat · Red Hat Enterprise Linux 9

  • unaffected 0:2.28-14.el9_6 – < *

• Red Hat · Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions

  • unaffected 0:2.25-12.el9_0 – < *

• Red Hat · Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

  • unaffected 0:2.28-5.el9_2 – < *

• Red Hat · Red Hat Enterprise Linux 9.4 Extended Update Support

  • unaffected 0:2.28-11.el9_4 – < *

What to do

Workaround: Currently, no mitigation is available for this vulnerability.

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• EUVD EUVD-2025-18685 (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2025-6019](https://cveledger.app/badge/CVE-2025-6019.svg)](https://cveledger.app/cve/CVE-2025-6019)

Record last updated 30 Jun 2026, 11:10 UTC.