ALSA-2026:96212: Important: util-linux security update

Q: Which components in the listed software are associated with the reported flaws?

The heap use-after-free affects libblkid nested partition probing, and the integer overflow affects the DOS partition parser. The TOCTOU issue is in the mount program and involves swapping an ancestor directory on the target path.

Q: What attacker conditions are stated for the mount-related issue?

The description identifies an ancestor directory swap on the mount target path as the condition involved in the TOCTOU issue. It does not state the required privileges, access level, or whether a default configuration is affected.

Q: How can I determine whether my installed packages include the affected components?

Check whether the system has the listed AlmaLinux util-linux component packages installed, including libblkid, libfdisk, libmount, libsmartcols, or their -devel packages. The provided data does not include affected or fixed package versions.

Published Nov 9, 2026

Updated

The util-linux packages contain a large variety of low-level system utilities that are necessary for a Linux system to function. Among others, these include the fdisk configuration tool and the login program.

Security Fix(es):

util-linux: util-linux: heap use-after-free in libblkid nested partition probing (CVE-2026-13595) util-linux: TOCTOU in the mount program via ancestor directory swap on target path (CVE-2026-53613) util-linux: util-linux: Partition metadata compromise via integer overflow in DOS partition parser (CVE-2026-53615)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected Software

14 affected componentsFixes available

almalinux/libblkid<2.32.1-50.el8_10

2.32.1-50.el8_10

almalinux/libblkid-devel<2.32.1-50.el8_10

2.32.1-50.el8_10

almalinux/libfdisk<2.32.1-50.el8_10

2.32.1-50.el8_10

almalinux/libfdisk-devel<2.32.1-50.el8_10

2.32.1-50.el8_10

almalinux/libmount<2.32.1-50.el8_10

2.32.1-50.el8_10

almalinux/libmount-devel<2.32.1-50.el8_10

2.32.1-50.el8_10

almalinux/libsmartcols<2.32.1-50.el8_10

2.32.1-50.el8_10

almalinux/libsmartcols-devel<2.32.1-50.el8_10

2.32.1-50.el8_10

almalinux/libuuid<2.32.1-50.el8_10

2.32.1-50.el8_10

almalinux/libuuid-devel<2.32.1-50.el8_10

2.32.1-50.el8_10

almalinux/python3-libmount<2.32.1-50.el8_10

2.32.1-50.el8_10

almalinux/util-linux<2.32.1-50.el8_10

2.32.1-50.el8_10

almalinux/util-linux-user<2.32.1-50.el8_10

2.32.1-50.el8_10

almalinux/uuidd<2.32.1-50.el8_10

2.32.1-50.el8_10

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade almalinux/libblkid to a version that resolves this vulnerability.
Fixed in 2.32.1-50.el8_10
Upgrade
Upgrade almalinux/libblkid-devel to a version that resolves this vulnerability.
Fixed in 2.32.1-50.el8_10
Upgrade
Upgrade almalinux/libfdisk to a version that resolves this vulnerability.
Fixed in 2.32.1-50.el8_10
Upgrade
Upgrade almalinux/libfdisk-devel to a version that resolves this vulnerability.
Fixed in 2.32.1-50.el8_10
Upgrade
Upgrade almalinux/libmount to a version that resolves this vulnerability.
Fixed in 2.32.1-50.el8_10
Upgrade
Upgrade almalinux/libmount-devel to a version that resolves this vulnerability.
Fixed in 2.32.1-50.el8_10
Upgrade
Upgrade almalinux/libsmartcols to a version that resolves this vulnerability.
Fixed in 2.32.1-50.el8_10
Upgrade
Upgrade almalinux/libsmartcols-devel to a version that resolves this vulnerability.
Fixed in 2.32.1-50.el8_10
Upgrade
Upgrade almalinux/libuuid to a version that resolves this vulnerability.
Fixed in 2.32.1-50.el8_10
Upgrade
Upgrade almalinux/libuuid-devel to a version that resolves this vulnerability.
Fixed in 2.32.1-50.el8_10
Upgrade
Upgrade almalinux/python3-libmount to a version that resolves this vulnerability.
Fixed in 2.32.1-50.el8_10
Upgrade
Upgrade almalinux/util-linux to a version that resolves this vulnerability.
Fixed in 2.32.1-50.el8_10
Upgrade
Upgrade almalinux/util-linux-user to a version that resolves this vulnerability.
Fixed in 2.32.1-50.el8_10
Upgrade
Upgrade almalinux/uuidd to a version that resolves this vulnerability.
Fixed in 2.32.1-50.el8_10

Event History

Nov 9, 2026

Advisory Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

Which components in the listed software are associated with the reported flaws?

The heap use-after-free affects libblkid nested partition probing, and the integer overflow affects the DOS partition parser. The TOCTOU issue is in the mount program and involves swapping an ancestor directory on the target path.

What attacker conditions are stated for the mount-related issue?

The description identifies an ancestor directory swap on the mount target path as the condition involved in the TOCTOU issue. It does not state the required privileges, access level, or whether a default configuration is affected.

How can I determine whether my installed packages include the affected components?

Check whether the system has the listed AlmaLinux util-linux component packages installed, including libblkid, libfdisk, libmount, libsmartcols, or their -devel packages. The provided data does not include affected or fixed package versions.

ALSA-2026:96212: Important: util-linux security update

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which components in the listed software are associated with the reported flaws?

What attacker conditions are stated for the mount-related issue?

How can I determine whether my installed packages include the affected components?

Company

Resources

Contact

Frequently Asked Questions

Which components in the listed software are associated with the reported flaws?

What attacker conditions are stated for the mount-related issue?

How can I determine whether my installed packages include the affected components?