Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-7867: Local privilege escalation via as-user mount spoofing NOTE: https://github.com/azqzazq1/CVE-2026-7867-disk2root
Fixed packages 10
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | libudisks2 | 0:2.10.1-6.amzn2023.0.4 |
| Amazon Linux · 2023 | libudisks2-debuginfo | 0:2.10.1-6.amzn2023.0.4 |
| Amazon Linux · 2023 | libudisks2-devel | 0:2.10.1-6.amzn2023.0.4 |
| Amazon Linux · 2023 | udisks2 | 0:2.10.1-6.amzn2023.0.4 |
| Amazon Linux · 2023 | udisks2-debuginfo | 0:2.10.1-6.amzn2023.0.4 |
| Amazon Linux · 2023 | udisks2-debugsource | 0:2.10.1-6.amzn2023.0.4 |
| Amazon Linux · 2023 | udisks2-lsm | 0:2.10.1-6.amzn2023.0.4 |
| Amazon Linux · 2023 | udisks2-lsm-debuginfo | 0:2.10.1-6.amzn2023.0.4 |
| Amazon Linux · 2023 | udisks2-lvm2 | 0:2.10.1-6.amzn2023.0.4 |
| Amazon Linux · 2023 | udisks2-lvm2-debuginfo | 0:2.10.1-6.amzn2023.0.4 |
Vulnerabilities 1
-
High 7.8CVE-2026-7867 Public exploit
Udisks2: udisks2: local privilege escalation via as-user option spoofing
A flaw was found in udisks2. A local attacker with an active console session can exploit insufficient authorization checking on the 'as-user' option in the org.freedesktop.UDisks2.Filesystem.Mount() D-Bus method. This allows the attacker to spoof the 'as-user…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-7867.html