p PatchFirst

CVE-2026-7867

CVE-2026-7867 · Udisks2: udisks2: local privilege escalation via as-user option spoofing

This page contains facts from public vulnerability sources. Check the original advisory before updating.

A flaw was found in udisks2. A local attacker with an active console session can exploit insufficient authorization checking on the 'as-user' option in the org.freedesktop.UDisks2.Filesystem.Mount() D-Bus method. This allows the attacker to spoof the 'as-user' parameter, mounting filesystems on behalf of arbitrary users, including privileged accounts. This can lead to local privilege escalation through mount point injection and manipulation of the mount namespace visible to privileged users.

CVSS 7.8 · High · EPSS 0.2% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • red hat enterprise linux 10

    Versions
    • ≥ 0:2.11.0-2.el10_2.1: Not affected (rpm)

    No fix published

  • red hat enterprise linux 10.0 extended update support

    Versions
    • ≥ 0:2.10.90-5.el10_0.3: Not affected (rpm)

    No fix published

  • red hat enterprise linux 7

    No fix published

  • red hat enterprise linux 8

    No fix published

  • red hat enterprise linux 9

    No fix published

  • udisks2 Debian:13

    Versions
    • 2.10.1-12.1
    • 2.10.1-12.1+deb13u1
    Affected ranges
    • ECOSYSTEM: < 2.10.1-12.1+deb13u2

    Update to 2.10.1-12.1+deb13u2

  • udisks2 Debian:14

    Versions
    • 2.10.1-12.1
    • 2.10.90-1
    • 2.10.90-2
    • 2.10.90-3
    • 2.10.90-3.1
    • 2.10.91-1
    • 2.11.0-1
    • 2.11.0-2
    • 2.11.1-1
    • 2.11.1-2
    Affected ranges
    • ECOSYSTEM: < 2.11.2-1

    Update to 2.11.2-1

  • udisks2 Ubuntu:24.04:LTS

    Versions
    • 2.10.1-1ubuntu1
    • 2.10.1-1ubuntu2
    • 2.10.1-6
    • 2.10.1-6build1
    • 2.10.1-6ubuntu1
    • 2.10.1-6ubuntu1.2
    • 2.10.1-6ubuntu1.3
    Affected ranges
    • ECOSYSTEM: < 2.10.1-6ubuntu1.5

    Update to 2.10.1-6ubuntu1.5

  • udisks2 Ubuntu:26.04:LTS

    Versions
    • 2.10.1-12.1ubuntu2
    • 2.10.91-1ubuntu1
    • 2.10.91-1ubuntu2
    Affected ranges
    • ECOSYSTEM: < 2.10.91-1ubuntu2.1

    Update to 2.10.91-1ubuntu2.1

Original sources

Check your server →