IT SBIT Services
Schneeberger
DEEN
CVE tracker

util-linux libblkid: Integer overflow in DOS extended partition parsing

CVE-2026-53615High 8.0

← All vulnerabilities

Summary

The libblkid library in util-linux computes DOS extended partition start sectors using 32-bit arithmetic without complete bounds checks on the first two EBR entries. A local attacker who gets a crafted DOS extended-partition disk image or removable medium probed can cause libblkid to report a false partition overlapping the MBR. The impact is on the integrity of the reported partition metadata; disk modification or availability loss requires a downstream tool to act on that metadata.

Affected

  • util-linux versions before 2.41.4 (CVE record)
  • Upstream advisory lists affected versions <= 2.41 with patched version 2.42; the version conflict is not yet resolved
  • Distribution status: Debian 12 (bookworm) 2.38.1-5+deb12u3 listed as vulnerable; Ubuntu 22.04, 24.04 and 26.04 fixed in the USN-8702-1 versions; Red Hat Enterprise Linux 7 to 10 affected, no shipped fix found

Fixed in

  • util-linux 2.41.4 (CVE record); verify against the release notes, as the upstream advisory states 2.42
  • Debian trixie: 2.41.5-0+deb13u1; forky/sid: 2.42.3-1
  • Ubuntu 26.04: 2.41.3-3ubuntu2.2; 24.04: 2.39.3-9ubuntu6.6; 22.04: 2.37.2-4ubuntu3.6

Workaround

  • Unknown. No vendor-documented workaround; patching is the remedy.
  • Interim measure: do not automatically probe untrusted USB sticks or disk images, and disable automount for removable media where not needed.

Exploitation

  • No evidence of exploitation in the sources; not listed in CISA KEV as checked by the research.
  • No public proof of concept found; this is a search gap, not confirmed absence.
  • EPSS reported as 0.00178 in one SUSE-sourced entry.
  • CISA SSVC: Exploitation none, Automatable no, Technical Impact partial.

Our recommendation

  • Patch libblkid/util-linux to the fixed version of your distribution, starting with systems still on Debian 12 (bookworm).
  • Prioritise Linux workstations with automount and systems that handle external drives.
  • Do not let servers or workstations automatically probe untrusted USB sticks or disk images until patched.
  • Check your distribution's security advisory for the exact fixed package version.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 21:21.

Original description (NVD)

util-linux is a random collection of Linux utilities. Before util-linux 2.41.4, `parse_dos_extended()` in `libblkid/src/partitions/dos.c` computes an extended-partition start sector with 32-bit addition and does not apply the extended-area bounds checks to the first two EBR entries. A local attacker who causes a crafted DOS extended-partition disk image or removable medium to be probed can wrap `cur_start + start` to sector zero and cause libblkid to report a false partition overlapping the MBR. This directly compromises the integrity of the reported partition metadata; disk modification or availability loss requires a separate downstream consumer to act on that metadata. This issue is fixed in 2.41.4.

NVD references (5)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed