Description
A flaw was found in util-linux. This vulnerability allows a heap buffer overread when processing 256-byte usernames, specifically within the `setpwnam()` function, affecting SUID (Set User ID) login-utils utilities writing to the password database.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| util-linux | util-linux | < 2.41.3 | 2.41.3 |
| Red Hat | Red Hat Enterprise Linux 10 | — | — |
| Red Hat | Red Hat Enterprise Linux 8 | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
| Red Hat | Cert Manager support for Red Hat OpenShift release 1.18 | — | — |
| Red Hat | Red Hat Ceph Storage 7 | — | — |
| Red Hat | Red Hat Ceph Storage 8 | — | — |
| Red Hat | Red Hat Ceph Storage 9 | — | — |
| Red Hat | Red Hat Hardened Images | — | — |
| Red Hat | Red Hat Insights proxy 1.5 | — | — |
| Red Hat | Red Hat Update Infrastructure 5 | — | — |
| Red Hat | Red Hat Enterprise Linux 6 | — | — |
| Red Hat | Red Hat Enterprise Linux 7 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | util-linux | 2.41.3-1 | — |
| Debian 13 | util-linux | 2.41.3-1 | — |
| Debian 12 | util-linux | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | util-linux | No fix yet | — |
| Ubuntu 14.04 LTS | util-linux | No fix yet | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | util-linux | No fix yet | — |
| Ubuntu Pro 16.04 LTS | util-linux | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | uuidd +13 | 2.40.2-15.el10_1 | RHSA-2026:1696 |
| RHEL 9 | uuidd +14 | 2.37.4-21.el9_7 | RHSA-2026:1913 |
| RHEL 8 | uuidd +13 | 2.32.1-48.el8_10 | RHSA-2026:1852 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | util-linux +3 | 2.42-7.1.hum1 | RHSA-2026:7180 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | uuidd +13 | 2.40.2-15.el10_1 | ALSA-2026:1696 |
| AlmaLinux 9 | uuidd +14 | 2.37.4-21.el9_7 | ALSA-2026:1913 |
| AlmaLinux 8 | uuidd +13 | 2.32.1-48.el8_10 | ALSA-2026:1852 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | util-linux | 2.40.2-15.el10_1 | RLSA-2026:1696 |
| Rocky Linux 9 | util-linux | 2.37.4-21.el9 | RLSA-2026:1913 |
| Rocky Linux 8 | util-linux | 2.32.1-48.el8_10 | RLSA-2026:1852 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | util-linux +1 | 2.40.4-150700.4.3.1 | SUSE-SU-2026:0230-1 |
| SLES 12 SP5 | util-linux +2 | 2.33.2-4.48.1 | SUSE-SU-2026:0366-1 |
Show 9 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | util-linux +2 | 2.41.1-160000.3.1 | SUSE-SU-2026:21158-1 |
| SLES 16.0 | util-linux +2 | 2.41.1-160000.3.1 | SUSE-SU-2026:21158-1 |
| SLE Micro 6.2 | util-linux +1 | 2.41.1-160000.3.1 | SUSE-SU-2026:21016-1 |
| SLE Micro 6.1 | util-linux +1 | 2.40.4-slfo.1.1_3.1 | SUSE-SU-2026:20365-1 |
| SLE Micro 6.0 | util-linux +1 | 2.39.3-4.1 | SUSE-SU-2026:20346-1 |
| SLE Micro 5.5 | util-linux +1 | 2.37.4-150500.9.20.1 | SUSE-SU-2026:0117-1 |
| SLE Micro 5.4 | util-linux +1 | 2.37.2-150400.8.38.1 | SUSE-SU-2026:0510-1 |
| SLE Micro 5.3 | util-linux +1 | 2.37.2-150400.8.38.1 | SUSE-SU-2026:0510-1 |
| SLE Micro 5.2 | util-linux +1 | 2.36.2-150300.4.50.1 | SUSE-SU-2026:0116-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | util-linux | 2.41.3-1.1 | openSUSE-SU-2026:10072-1 |
| openSUSE Leap 16.0 | util-linux +2 | 2.41.1-160000.3.1 | openSUSE-SU-2026:20495-1 |
| openSUSE Leap 15.6 | python-libmount +1 | 2.39.3-150600.4.15.1 | SUSE-SU-2026:0115-1 |
| openSUSE Leap 15.6 | util-linux +1 | 2.37.4-150500.9.20.1 | SUSE-SU-2026:0117-1, SUSE-SU-2026:0115-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.23 | util-linux | 2.41.4-r0 | — |
| Alpine v3.22 | util-linux | 2.41.6-r0 | — |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | util-linux | 2.40.2-3 | — |
| Azure Linux 2 (CBL-Mariner) | util-linux | 2.37.4-10 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | uuidd +13 | 2.40.2-15.el10_1 | ELSA-2026-1696 |
| Oracle Linux 9 | uuidd +14 | 2.37.4-21.0.1.el9_7 | ELSA-2026-1913 |
| Oracle Linux 8 | uuidd +13 | 2.32.1-48.0.1.el8_10 | ELSA-2026-1852 |
Advisories 29
- ALSA-2026:1696 Moderate: util-linux security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:1913 Moderate: util-linux security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:1852 Moderate: util-linux security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2026:7180 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2026:1913 Red Hat Security Advisory: util-linux security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2026:1852 Red Hat Security Advisory: util-linux security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2026:1696 Red Hat Security Advisory: util-linux security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- WID-SEC-2026-0783 IBM QRadar SIEM: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 17, 2026
- WID-SEC-2026-2253 IBM Security Verify Access: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 17, 2026
- WID-SEC-2025-2755 util-linux: Schwachstelle ermöglicht Denial of Service und Offenlegung von Informationen BSI CERT-Bund (WID) · Aug 31, 2026
- openSUSE-SU-2026:20495-1 Security update for util-linux SUSE / openSUSE Security Updates · Apr 22, 2026
- SUSE-SU-2026:21158-1 Security update for util-linux SUSE / openSUSE Security Updates · Apr 22, 2026
- WID-SEC-2026-1194 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 21, 2026
- SUSE-SU-2026:21016-1 Security update for util-linux SUSE / openSUSE Security Updates · Apr 14, 2026
- openSUSE-SU-2026:10072-1 libblkid-devel-2.41.3-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2026:20346-1 Security update for util-linux SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2026:20365-1 Security update for util-linux SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2026:0510-1 Security update for util-linux SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2026:0230-1 Security update for util-linux SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2026:0366-1 Security update for util-linux SUSE / openSUSE Security Updates · Mar 23, 2026
- RLSA-2026:1852 Moderate: util-linux security update Rocky Linux Security Advisories · Feb 6, 2026
- RLSA-2026:1696 Moderate: util-linux security update Rocky Linux Security Advisories · Feb 5, 2026
- RLSA-2026:1913 Moderate: util-linux security update Rocky Linux Security Advisories · Feb 5, 2026
- SUSE-SU-2026:0116-1 Security update for util-linux SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2026:0115-1 Security update for util-linux SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2026:0117-1 Security update for util-linux SUSE / openSUSE Security Updates · Feb 4, 2026
- ELSA-2026-1913 Moderate: util-linux security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Feb 4, 2026
- ELSA-2026-1852 Moderate: util-linux security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Feb 4, 2026
- ELSA-2026-1696 Moderate: util-linux security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Feb 2, 2026
References
- RHSA-2026:1696 vendor-advisory
- RHSA-2026:1852 vendor-advisory
- RHSA-2026:1913 vendor-advisory
- RHSA-2026:2485 vendor-advisory
- RHSA-2026:2563 vendor-advisory
- RHSA-2026:2737 vendor-advisory
- RHSA-2026:2800 vendor-advisory
- RHSA-2026:3406 vendor-advisory
- RHSA-2026:4943 vendor-advisory
- RHSA-2026:7180 vendor-advisory
- RHSA-2026:82347 vendor-advisory
- RHSA-2026:82354 vendor-advisory
- RHSA-2026:82372 vendor-advisory
- RHSA-2026:82857 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2025-14104 vdb-entry
- RHBZ#2419369 issue-tracking