Description
util-linux is a random collection of Linux utilities. Before util-linux 2.41.4, `parse_dos_extended()` in `libblkid/src/partitions/dos.c` computes an extended-partition start sector with 32-bit addition and does not apply the extended-area bounds checks to the first two EBR entries. A local attacker who causes a crafted DOS extended-partition disk image or removable medium to be probed can wrap `cur_start + start` to sector zero and cause libblkid to report a false partition overlapping the MBR. This directly compromises the integrity of the reported partition metadata; disk modification or availability loss requires a separate downstream consumer to act on that metadata. This issue is fixed in 2.41.4.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| util-linux | util-linux | < 2.41.4 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | util-linux | 2.42-1 | — |
| Debian 13 | util-linux | 2.41.5-0+deb13u1 | — |
| Debian 12 | util-linux | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | util-linux | No fix yet | — |
| Ubuntu 26.04 LTS | util-linux | 2.41.3-3ubuntu2.2 | USN-8702-1 |
| Ubuntu 25.10 | util-linux | No fix yet | — |
| Ubuntu 24.04 LTS | util-linux | 2.39.3-9ubuntu6.6 | USN-8702-1 |
| Ubuntu 22.04 LTS | util-linux | 2.37.2-4ubuntu3.6 | USN-8702-1 |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | util-linux | No fix yet | — |
| Ubuntu 14.04 LTS | util-linux | No fix yet | — |
| Ubuntu Pro 20.04 LTS | util-linux | No fix yet | — |
| Ubuntu Pro 16.04 LTS | util-linux | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | uuidd +13 | 2.40.2-18.el10_2.20 | RHSA-2026:98630, RHSA-2026:93461 |
| RHEL 9 | uuidd +14 | 2.37.4-28.el9_9.1 | RHSA-2026:98519 |
| RHEL 8 | uuidd +13 | 2.32.1-50.el8_10 | RHSA-2026:96212 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9.8 EUS | uuidd +14 | 2.37.4-25.el9_8.2 | RHSA-2026:99119 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | uuidd +13 | 2.40.2-18.el10_2.20 | ALSA-2026:93461 |
| AlmaLinux 8 | uuidd +13 | 2.32.1-50.el8_10 | ALSA-2026:96212 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | util-linux | 2.40.2-18.el10_2.20 | RLSA-2026:93461 |
| Rocky Linux 9 | uuidd +14 | 2.37.4-28.el9_9.1 | RLSA-2026:98519 |
| Rocky Linux 8 | util-linux | 2.32.1-50.el8_10 | RLSA-2026:96212 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | uuidd +14 | 2.37.4-1.amzn2023.0.5 | ALAS2023-2026-1916 |
| Amazon Linux 2 | uuidd +13 | 2.30.2-2.amzn2.0.14 | ALAS2-2026-3789 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | util-linux | 2.40.2-7 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | uuidd +13 | 2.40.2-18.0.1.el10_2.20 | ELSA-2026-93461 |
| Oracle Linux 8 | uuidd +13 | 2.32.1-50.0.1.el8_10 | ELSA-2026-96212 |
Advisories 17
- RHSA-2026:99119 Red Hat Security Advisory: util-linux security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:98630 Red Hat Security Advisory: util-linux security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:98519 Red Hat Security Advisory: util-linux security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:96212 Red Hat Security Advisory: util-linux security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:93461 Red Hat Security Advisory: util-linux security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RLSA-2026:98519 Important: util-linux security update Rocky Linux Security Advisories · Nov 13, 2026
- WID-SEC-2026-2938 util-linux: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 12, 2026
- RLSA-2026:96212 Important: util-linux security update Rocky Linux Security Advisories · Nov 10, 2026
- ALSA-2026:96212 Important: util-linux security update AlmaLinux Security Advisories · Nov 9, 2026
- ELSA-2026-96212 Important: util-linux security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Nov 9, 2026
- RLSA-2026:93461 Important: util-linux security update Rocky Linux Security Advisories · Nov 3, 2026
- ALSA-2026:93461 Important: util-linux security update AlmaLinux Security Advisories · Nov 2, 2026
- ELSA-2026-93461 Important: util-linux security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Nov 2, 2026
- USN-8702-1 util-linux vulnerabilities Ubuntu Security Notices (USN) · Oct 17, 2026
- WID-SEC-2026-3642 Meinberg LANTIME: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 14, 2026
- ALAS2-2026-3789 Important: util-linux security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Jul 7, 2026
- ALAS2023-2026-1916 Important: util-linux security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Jul 7, 2026
References
- https://github.com/util-linux/util-linux/security/advisories/GHSA-h4rw-gv36-wmp5
- https://github.com/util-linux/util-linux/commit/05c2dbadf34cc74192287f377904afaaf4061623
- https://github.com/util-linux/util-linux/commit/a2d858176b609ab5b8535021a3af9cd302d23d31
- https://github.com/util-linux/util-linux/commit/e9d544d013267ea86b70ee8ff78abd280e6641af
- https://github.com/util-linux/util-linux/releases/tag/v2.41.4