Description
runuser in util-linux allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | util-linux | 2.31.1-0.1 | — |
| Debian 13 | util-linux | 2.31.1-0.1 | — |
| Debian 12 | util-linux | 2.31.1-0.1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | util-linux | No fix yet | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | util-linux | 2.28.2-2.1 | openSUSE-SU-2024:10279-1 |
Advisories 1
- openSUSE-SU-2024:10279-1 libblkid-devel-2.28.2-2.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026