Live › vulnerability › CVE-2026-111581
Go to dashboardlibblockdev passes filesystem label values to the ntfslabel and fatlabel tools without stopping option parsing, so a label starting with a dash is read as a command-line flag. Unprivileged local users can reach this through the udisks2 Filesystem.SetLabel() D-Bus method without administrator authentication.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running libblockdev with udisks2 exposed on local D-Bus, where unprivileged local users can call Filesystem.SetLabel() on NTFS or FAT volumes. Machines without udisks2 or without NTFS/FAT labelling tools are less exposed. The sources do not state a patched version.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw was found in libblockdev. The bd_fs_ntfs_set_label() and bd_fs_vfat_set_label() functions pass caller-supplied label values as bare positional arguments to the ntfslabel and fatlabel utilities without end-of-options separators or input validation for values beginning with a dash. This allows a label starting with '-' to be interpreted as a command-line flag by the spawned tool, potentially bypassing safety checks or causing unintended operations. This is reachable by unprivileged local users through the udisks2 Filesystem.SetLabel() D-Bus method without administrator authentication.
This page as .md · .json · in your agent: get_signal("CVE-2026-111581")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.