Description
A Local Privilege Escalation (LPE) vulnerability was found in libblockdev. Generally, the "allow_active" setting in Polkit permits a physically present user to take certain actions based on the session type. Due to the way libblockdev interacts with the udisks daemon, an "allow_active" user on a system may be able escalate to full root privileges on the target host. Normally, udisks mounts user-provided filesystem images with security flags like nosuid and nodev to prevent privilege escalation. However, a local attacker can create a specially crafted XFS image containing a SUID-root shell, then trick udisks into resizing it. This mounts their malicious filesystem with root privileges, allowing them to execute their SUID-root shell and gain complete control of the system.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | libblockdev | < 3.3.1 | 3.3.1 |
| Red Hat | Red Hat Enterprise Linux 10 | — | — |
| Red Hat | Red Hat Enterprise Linux 7 Extended Lifecycle Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8 | — | — |
| Red Hat | Red Hat Enterprise Linux 8.2 Advanced Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8.6 Telecommunications Update Service | — | — |
| Red Hat | Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
| Red Hat | Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 9.4 Extended Update Support | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libblockdev | 3.3.0-2.1 | — |
| Debian 13 | libblockdev | 3.3.0-2.1 | — |
| Debian 12 | libblockdev | 2.28-2+deb12u1 | DSA-5943-1 |
| Debian 11 | libblockdev | 2.25-2+deb11u1 | DLA-4221-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 25.10 | udisks2 | 2.10.1-12.1ubuntu1 | — |
| Ubuntu 24.04 LTS | libblockdev | 3.1.1-1ubuntu0.1 | USN-7577-1 |
| Ubuntu 24.04 LTS | udisks2 | 2.10.1-6ubuntu1.2 | USN-7578-1 |
| Ubuntu 22.04 LTS | libblockdev | 2.26-1ubuntu0.1 | USN-7577-1 |
| Ubuntu 22.04 LTS | udisks2 | 2.9.4-1ubuntu2.2 | USN-7578-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | libblockdev | 2.23-2ubuntu3+esm1 | USN-7577-2 |
| Ubuntu Pro 20.04 LTS | udisks2 | 2.8.4-1ubuntu2+esm1 | USN-7578-2 |
| Ubuntu Pro 18.04 LTS | libblockdev | 2.16-2ubuntu0.1~esm1 | USN-7577-2 |
| Ubuntu Pro 18.04 LTS | udisks2 | 2.7.6-3ubuntu0.2+esm1 | USN-7578-2 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | libblockdev +19 | 3.2.0-4.el10_0 | RHSA-2025:9328 |
| RHEL 9 | libblockdev +18 | 2.28-14.el9_6 | RHSA-2025:9327 |
| RHEL 8 | libblockdev +27 | 2.28-7.el8_10 | RHSA-2025:9878 |
Show 10 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9.4 EUS | libblockdev +18 | 2.28-11.el9_4 | RHSA-2025:9326 |
| RHEL 9.2 E4S | libblockdev +18 | 2.28-5.el9_2 | RHSA-2025:9325 |
| RHEL 9.0 E4S | libblockdev +17 | 2.25-12.el9_0 | RHSA-2025:9324 |
| RHEL 8.8 E4S | libblockdev +16 | 2.28-3.el8_8 | RHSA-2025:9323 |
| RHEL 8.6 TUS | libblockdev +16 | 2.24-9.el8_6 | RHSA-2025:9322 |
| RHEL 8.6 E4S | libblockdev +17 | 2.24-9.el8_6 | RHSA-2025:9322 |
| RHEL 8.6 AUS | libblockdev +16 | 2.24-9.el8_6 | RHSA-2025:9322 |
| RHEL 8.4 AUS | libblockdev +16 | 2.24-6.el8_4 | RHSA-2025:9321 |
| RHEL 8.2 AUS | libblockdev +16 | 2.19-13.el8_2 | RHSA-2025:9320 |
| RHEL 7 ELS | libblockdev +33 | 2.18-5.el7_9.1 | RHSA-2025:10796 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | libblockdev +36 | 3.2.0-3.el10_0.alma.1 | ALSA-2025:A006, ALSA-2025:9328 |
| AlmaLinux 9 | libblockdev +34 | 2.28-13.el9_6.alma.1 | ALSA-2025:A005, ALSA-2025:9327 |
| AlmaLinux 8 | libblockdev +34 | 2.28-6.el8.alma.1 | ALSA-2025:A004, ALSA-2025:9878 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | libblockdev | 3.2.0-4.el10_0 | RLSA-2025:9328 |
| Rocky Linux 9 | libblockdev | 2.28-14.el9_6 | RLSA-2025:9327 |
| Rocky Linux 8 | libblockdev | 2.28-7.el8_10 | RLSA-2025:9878 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | libblockdev | 2.26-150400.3.5.1 | SUSE-SU-2025:02044-1 |
| SLES 15 SP6 | libblockdev | 2.26-150400.3.5.1 | SUSE-SU-2025:02044-1 |
| SLES 15 SP5 | libblockdev | 2.26-150400.3.5.1 | SUSE-SU-2025:02044-1 |
| SLES 15 SP4 | libblockdev | 2.26-150400.3.5.1 | SUSE-SU-2025:02044-1 |
| SLES 15 SP3 | libblockdev | 2.22-150200.3.3.1 | SUSE-SU-2025:02043-1 |
Show 14 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 SP5 | libblockdev | 2.26-150400.3.5.1 | SUSE-SU-2025:02044-1 |
| SLES for SAP 15 SP4 | libblockdev | 2.26-150400.3.5.1 | SUSE-SU-2025:02044-1 |
| SLES for SAP 15 SP3 | libblockdev | 2.22-150200.3.3.1 | SUSE-SU-2025:02043-1 |
| SLE Micro 6.1 | libblockdev | 2.28-slfo.1.1_2.1 | SUSE-SU-2025:20440-1 |
| SLE Micro 6.0 | libblockdev | 2.28-2.1 | SUSE-SU-2025:20426-1 |
| SLE Micro 5.5 | libblockdev | 2.26-150400.3.5.1 | SUSE-SU-2025:02044-1 |
| SLE Micro 5.4 | libblockdev | 2.26-150400.3.5.1 | SUSE-SU-2025:02044-1 |
| SLE Micro 5.3 | libblockdev | 2.26-150400.3.5.1 | SUSE-SU-2025:02044-1 |
| SLE HPC 15 SP5 | libblockdev | 2.26-150400.3.5.1 | SUSE-SU-2025:02044-1 |
| SLE HPC 15 SP4 | libblockdev | 2.26-150400.3.5.1 | SUSE-SU-2025:02044-1 |
| SLE HPC 15 SP3 | libblockdev | 2.22-150200.3.3.1 | SUSE-SU-2025:02043-1 |
| SUSE Manager Server 4.3 | libblockdev | 2.26-150400.3.5.1 | SUSE-SU-2025:02044-1 |
| SUSE Manager Proxy 4.3 | libblockdev | 2.26-150400.3.5.1 | SUSE-SU-2025:02044-1 |
| SUSE Enterprise Storage 7.1 | libblockdev | 2.22-150200.3.3.1 | SUSE-SU-2025:02043-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | libblockdev | 3.1.1-2.1 | openSUSE-SU-2025:15237-1 |
| openSUSE Leap 15.6 | libblockdev | 2.26-150400.3.5.1 | SUSE-SU-2025:02044-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | libblockdev +34 | 3.2.1-1.amzn2023.0.3 | ALAS2023-2025-1020 |
| Amazon Linux 2023 | udisks2 +4 | 2.10.1-6.amzn2023.0.2 | ALAS2023-2025-1021 |
| Amazon Linux 2 | libblockdev +29 | 2.18-4.amzn2.0.2 | ALAS2-2025-2895 |
| Amazon Linux 2 | udisks2 +5 | 2.7.3-9.amzn2.0.3 | ALAS2-2025-2894 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | libblockdev | No fix yet | — |
| Azure Linux 2 (CBL-Mariner) | libblockdev | No fix yet | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | libblockdev +19 | 3.2.0-4.0.1.el10_0 | ELSA-2025-9328 |
| Oracle Linux 9 | libblockdev +18 | 2.28-14.0.1.el9_6 | ELSA-2025-9327 |
| Oracle Linux 8 | libblockdev +27 | 2.28-7.0.1.el8_10 | ELSA-2025-9878 |
| Oracle Linux 7 | libblockdev +31 | 2.18-5.0.1.el7 | ELSA-2025-10796 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
GitHub 11 repositories · most starred shown
-
guinea-offensive-security/CVE-2025-6019 ★ 71 · Jun 19, 2025
-
JM00NJ/CVE-2025-6019-udisks2-XFS-Resize-TOCTOU-Privilege-Escalation ★ 4 · Feb 13, 2026
CVE-2025-6019: udisks2 XFS Resize TOCTOU Privilege Escalation
-
And-oss/CVE-2025-6019-exploit ★ 4 · Jun 20, 2025
exploit
-
neko205-mx/CVE-2025-6019_Exploit ★ 3 · Jun 29, 2025
-
symphony2colour/CVE-2025-6019-udisks-lpe-no-image ★ 1 · Feb 10, 2026
Script-only privilege escalation chain using CVE-2025-6019 and UDisks2 (no filesystem image included).
-
0x5chltz/CVE-2025-6019 ★ 0 · Feb 9, 2026
-
phamdinhquy2512/CVE-2025-6019-Exploitation ★ 0 · Dec 14, 2025
-
robbin0919/CVE-2025-6019 ★ 0 · Dec 11, 2025
-
harshitvarma05/CVE-2025-6019 ★ 0 · Sep 3, 2025
-
JustThinkingHard/HID-Attack ★ 0 · Jun 20, 2025
Full BadUSB attack chain: keystroke-injection payload delivery, C2 client, privilege escalation (CVE-2025-6019), and systemd persistence on Linux.
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 40
- ALSA-2025:A006 Important: libblockdev security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2025:9328 Important: libblockdev security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2025:9327 Important: libblockdev security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2025:A005 Important: libblockdev security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2025:9878 Important: libblockdev security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2025:A004 Important: libblockdev security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2025:9878 Red Hat Security Advisory: libblockdev security update Red Hat Security Advisories (RHSA) · Jul 1, 2026
- RHSA-2025:9327 Red Hat Security Advisory: libblockdev security update Red Hat Security Advisories (RHSA) · Jul 1, 2026
- RHSA-2025:9328 Red Hat Security Advisory: libblockdev security update Red Hat Security Advisories (RHSA) · Jul 1, 2026
- RHSA-2025:9326 Red Hat Security Advisory: libblockdev security update Red Hat Security Advisories (RHSA) · Jul 1, 2026
- RHSA-2025:9324 Red Hat Security Advisory: libblockdev security update Red Hat Security Advisories (RHSA) · Jul 1, 2026
- RHSA-2025:9325 Red Hat Security Advisory: libblockdev security update Red Hat Security Advisories (RHSA) · Jul 1, 2026
- RHSA-2025:9323 Red Hat Security Advisory: libblockdev security update Red Hat Security Advisories (RHSA) · Jul 1, 2026
- RHSA-2025:9322 Red Hat Security Advisory: libblockdev security update Red Hat Security Advisories (RHSA) · Jul 1, 2026
- RHSA-2025:9320 Red Hat Security Advisory: libblockdev security update Red Hat Security Advisories (RHSA) · Jul 1, 2026
- RHSA-2025:9321 Red Hat Security Advisory: libblockdev security update Red Hat Security Advisories (RHSA) · Jul 1, 2026
- RHSA-2025:10796 Red Hat Security Advisory: libblockdev security update Red Hat Security Advisories (RHSA) · Jul 1, 2026
- USN-7577-1 libblockdev vulnerability Ubuntu Security Notices (USN) · Apr 22, 2026
- USN-7577-2 libblockdev vulnerability Ubuntu Security Notices (USN) · Apr 22, 2026
- USN-7578-1 udisks2 vulnerability Ubuntu Security Notices (USN) · Apr 22, 2026
- USN-7578-2 udisks2 vulnerability Ubuntu Security Notices (USN) · Apr 22, 2026
- openSUSE-SU-2025:15237-1 libbd_btrfs-devel-3.1.1-2.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:20440-1 Security update for libblockdev SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:02044-1 Security update for libblockdev SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:20426-1 Security update for libblockdev SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:02043-1 Security update for libblockdev SUSE / openSUSE Security Updates · Mar 23, 2026
- DSA-5943-1 libblockdev - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-4221-1 libblockdev - security update Debian Security (DSA / DLA) · Mar 9, 2026
- WID-SEC-2025-1354 Verschiedene Linux Distributionen: Mehrere Schwachstellen ermöglichen Privilegieneskalation BSI CERT-Bund (WID) · Nov 4, 2025
- RLSA-2025:9328 Important: libblockdev security update Rocky Linux Security Advisories · Oct 8, 2025
- RLSA-2025:9327 Important: libblockdev security update Rocky Linux Security Advisories · Oct 7, 2025
- ELSA-2025-10796 Important: libblockdev security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jul 31, 2025
- RLSA-2025:9878 Important: libblockdev security update Rocky Linux Security Advisories · Jul 29, 2025
- ELSA-2025-9878 Important: libblockdev security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Jun 30, 2025
- ELSA-2025-9328 Important: libblockdev security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Jun 27, 2025
- ALAS2-2025-2894 Moderate: udisks2 security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Jun 24, 2025
- ALAS2-2025-2895 Moderate: libblockdev security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Jun 24, 2025
- ALAS2023-2025-1020 Moderate: libblockdev security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Jun 23, 2025
- ALAS2023-2025-1021 Moderate: udisks2 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Jun 23, 2025
- ELSA-2025-9327 Important: libblockdev security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Jun 23, 2025
References
- RHSA-2025:10796 vendor-advisory
- RHSA-2025:9320 vendor-advisory
- RHSA-2025:9321 vendor-advisory
- RHSA-2025:9322 vendor-advisory
- RHSA-2025:9323 vendor-advisory
- RHSA-2025:9324 vendor-advisory
- RHSA-2025:9325 vendor-advisory
- RHSA-2025:9326 vendor-advisory
- RHSA-2025:9327 vendor-advisory
- RHSA-2025:9328 vendor-advisory
- RHSA-2025:9878 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2025-6019 vdb-entry
- RHBZ#2370051 issue-tracking
- https://cdn2.qualys.com/2025/06/17/suse15-pam-udisks-lpe.txt