{"id":"CVE-2026-111581","kind":"vulnerability","aliases":["CVE-2026-111581"],"related":[],"title":"libblockdev: filesystem label flags let local users pass options to ntfslabel and fatlabel","description":"A flaw was found in libblockdev. The bd_fs_ntfs_set_label() and bd_fs_vfat_set_label() functions pass caller-supplied label values as bare positional arguments to the ntfslabel and fatlabel utilities without end-of-options separators or input validation for values beginning with a dash. This allows a label starting with '-' to be interpreted as a command-line flag by the spawned tool, potentially bypassing safety checks or causing unintended operations. This is reachable by unprivileged local users through the udisks2 Filesystem.SetLabel() D-Bus method without administrator authentication.","summary":"libblockdev passes filesystem label values to the ntfslabel and fatlabel tools without stopping option parsing, so a label starting with a dash is read as a command-line flag. Unprivileged local users can reach this through the udisks2 Filesystem.SetLabel() D-Bus method without administrator authentication.","severity":"low","cvss":3.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["desktop","infrastructure","libblockdev","linux","servers-with-udisks2","udisks2"],"not_affected_if":["no-local-users","no-udisks2"],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-16T16:17:04+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-25T04:47:16+00:00","updated_at":"2026-10-25T04:47:16+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-25T04:47:16Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"local","title":"libblockdev: filesystem label flags let local users pass options to ntfslabel and fatlabel","impact":"low","summary":"libblockdev passes filesystem label values to the ntfslabel and fatlabel tools without stopping option parsing, so a label starting with a dash is read as a command-line flag. Unprivileged local users can reach this through the udisks2 Filesystem.SetLabel() D-Bus method without administrator authentication.","category":"infrastructure","nicknames":[],"who_cares":["linux","udisks2","libblockdev","desktop","servers-with-udisks2"],"confidence":0.5,"needs_auth":"no","worst_case":"local user triggers unintended ntfslabel or fatlabel operations via injected flags","analyst_note":"Find the patched libblockdev and udisks2 versions and the vendor advisory; the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-111581 has no fix version listed.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-udisks2","no-local-users"],"who_is_affected":"Systems running libblockdev with udisks2 exposed on local D-Bus, where unprivileged local users can call Filesystem.SetLabel() on NTFS or FAT volumes. Machines without udisks2 or without NTFS/FAT labelling tools are less exposed. The sources do not state a patched version.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.00061,"input_tokens":3392,"output_tokens":541,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-111581':16A,19A '-2026':15A,18A 'administr':74B,169C 'allow':127C 'argument':104C 'authent':75B,170C 'bare':102C 'bd':83C,89C 'begin':122C 'bus':71B,166C 'bypass':146C 'caller':97C 'caller-suppli':96C 'caus':150C 'check':148C 'command':56B,138C 'command-lin':55B,137C 'cve':14A,17A 'd':70B,165C 'd-bus':69B,164C 'dash':50B,125C 'desktop':20B 'end':113C 'end-of-opt':112C 'fatlabel':13A,38B,109C 'filesystem':2A,31B 'filesystem.setlabel':68B,163C 'flag':4A,58B,140C 'flaw':77C 'found':79C 'fs':84C,90C 'function':94C 'infrastructur':21B 'input':118C 'interpret':134C 'label':3A,32B,46B,87C,93C,99C,129C 'let':5A 'libblockdev':1A,22B,29B,81C 'line':57B,139C 'linux':23B 'local':6A,60B,158C 'method':72B,167C 'ntfs':85C 'ntfslabel':11A,36B,107C 'oper':152C 'option':9A,42B,115C 'pars':43B 'pass':8A,30B,95C 'posit':103C 'potenti':145C 'reach':63B 'reachabl':155C 'read':52B 'safeti':147C 'separ':116C 'server':25B 'servers-with-udisks2':24B 'set':86C,92C 'spawn':143C 'start':47B,130C 'stop':41B 'suppli':98C 'tool':39B,144C 'udisks2':27B,28B,67B,162C 'unintend':151C 'unprivileg':59B,157C 'user':7A,61B,159C 'util':110C 'valid':119C 'valu':33B,100C,121C 'vfat':91C 'without':40B,73B,111C,168C","nicknames":[],"mitigations":[],"who_affected":"Systems running libblockdev with udisks2 exposed on local D-Bus, where unprivileged local users can call Filesystem.SetLabel() on NTFS or FAT volumes. Machines without udisks2 or without NTFS/FAT labelling tools are less exposed. The sources do not state a patched version.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T16:17:04+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111581","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111581","severity":null,"published_at":"2026-10-16T16:17:04+00:00","modified_at":"2026-10-16T19:23:18+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}