p PatchFirst

CVE-2026-111581

CVE-2026-111581 · Libblockdev: libblockdev: argument injection in ntfs/vfat label-setting helpers via udisks2 setlabel() d-bus method

This page contains facts from public vulnerability sources. Check the original advisory before updating.

A flaw was found in libblockdev. The bd_fs_ntfs_set_label() and bd_fs_vfat_set_label() functions pass caller-supplied label values as bare positional arguments to the ntfslabel and fatlabel utilities without end-of-options separators or input validation for values beginning with a dash. This allows a label starting with '-' to be interpreted as a command-line flag by the spawned tool, potentially bypassing safety checks or causing unintended operations. This is reachable by unprivileged local users through the udisks2 Filesystem.SetLabel() D-Bus method without administrator authentication.

CVSS 3.3 · Low · EPSS 0.1%

Published
Updated

Stack: system

Affected products and versions

  • red hat enterprise linux 10

    No fix published

  • red hat enterprise linux 7

    No fix published

  • red hat enterprise linux 8

    No fix published

  • red hat enterprise linux 9

    No fix published

  • libblockdev Debian:12

    Versions
    • 2.28-2
    • 2.28-2+deb12u1
    • 3.0-1
    • 3.0-2
    • 3.0.1-1
    • 3.0.1-2
    • 3.0.2-1
    • 3.0.2-2
    • 3.0.2-3
    • 3.0.3-1
    • 3.0.4-1
    • 3.1.0-1
    • 3.1.1-1
    • 3.1.1-2
    • 3.2.0-1
    • 3.2.0-2
    • 3.2.1-1
    • 3.3.0-1
    • 3.3.0-2
    • 3.3.0-2.1
    • 3.3.1-1
    • 3.3.1-2
    • 3.3.1-3
    • 3.4.0-1
    • 3.4.0-2
    • 3.5.0-1
    • 3.5.0-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libblockdev Debian:13

    Versions
    • 3.3.0-2.1
    • 3.3.1-1
    • 3.3.1-2
    • 3.3.1-3
    • 3.4.0-1
    • 3.4.0-2
    • 3.5.0-1
    • 3.5.0-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libblockdev Debian:14

    Versions
    • 3.3.0-2.1
    • 3.3.1-1
    • 3.3.1-2
    • 3.3.1-3
    • 3.4.0-1
    • 3.4.0-2
    • 3.5.0-1
    • 3.5.0-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libblockdev Ubuntu:Pro:18.04:LTS

    Versions
    • 2.12-2
    • 2.12-3
    • 2.14-2
    • 2.14-3
    • 2.16-2
    • 2.16-2ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libblockdev Ubuntu:Pro:20.04:LTS

    Versions
    • 2.22-1
    • 2.23-2
    • 2.23-2ubuntu2
    • 2.23-2ubuntu3
    • 2.23-2ubuntu3+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libblockdev Ubuntu:22.04:LTS

    Versions
    • 2.25-2build1
    • 2.26-1
    • 2.26-1ubuntu0.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libblockdev Ubuntu:24.04:LTS

    Versions
    • 3.0.3-1
    • 3.0.4-1
    • 3.1.0-1
    • 3.1.0-1build1
    • 3.1.1-1
    • 3.1.1-1ubuntu0.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libblockdev Ubuntu:26.10

    Versions
    • 3.4.0-1
    • 3.5.0-1
    • 3.5.0-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libblockdev Ubuntu:26.04:LTS

    Versions
    • 3.3.0-2.1
    • 3.4.0-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →