CVE-2026-111581: Libblockdev: libblockdev: argument injection in ntfs/vfat label-setting helpers via udisks2 setlabel() d-bus method
A flaw was found in libblockdev. The bdfsntfssetlabel() and bdfsvfatsetlabel() functions pass caller-supplied label values as bare positional arguments to the ntfslabel and fatlabel utilities without end-of-options separators or input validation for values beginning with a dash. This allows a label starting with '-' to be interpreted as a command-line flag by the spawned tool, potentially bypassing safety checks or causing unintended operations. This is reachable by unprivileged local users through the udisks2 Filesystem.SetLabel() D-Bus method without administrator authentication.
Other sources
A flaw was found in libblockdev's NTFS and VFAT filesystem plugins. The bdfsntfssetlabel() and bdfsvfatsetlabel() functions pass a caller-supplied label as a bare positional argument to the external ntfslabel and fatlabel binaries without a "--" end-of-options separator and without rejecting values that begin with "-". Because both tools use standard getopt-style option parsing, a label value that matches a recognized flag is interpreted as that flag instead of as literal label text.
This is reachable by any unprivileged local user with an active desktop session through udisks2's Filesystem.SetLabel() D-Bus method, which requires no administrator authentication for user-owned devices (polkit allowactive: yes for org.freedesktop.udisks2.modify-device).
Confirmed end-to-end: injecting "-f" as a label on a mounted NTFS device bypasses ntfslabel's mount-safety guard — the D-Bus method returns success but performs a query (no-op) instead of the requested label change. At the binary level, "--new-serial" causes ntfslabel to randomize the filesystem UUID (metadata corruption), though this was not reproducible through the D-Bus path due to ntfs-3g's exclusive device locking.
For VFAT, libblockdev's uppercasing of the label accidentally mitigates most fatlabel flags. The only surviving injection is "-v"/"-V" (version print, exit 0, no data change).
The vulnerability is classified as CWE-88 (Improper Neutralization of Argument Delimiters in a Command). The attack is local-only and limited to devices the user already has polkit authorization to modify. No RCE path or cross-user attack was identified.
Analysis was heavily AI-assisted.
Reported by: Yashashree Gund via PSIRTSUPT-25820.
— Red Hat