OESA-2026-4576: util-linux security update
The util-linux package contains a random collection of files that implements some low-level basic linux utilities. Security Fix(es):
util-linux is a random collection of Linux utilities. Before util-linux 2.41.4, parsedosextended() in libblkid/src/partitions/dos.c computes an extended-partition start sector with 32-bit addition and does not apply the extended-area bounds checks to the first two EBR entries. A local attacker who causes a crafted DOS extended-partition disk image or removable medium to be probed can wrap curstart + start to sector zero and cause libblkid to report a false partition overlapping the MBR. This directly compromises the integrity of the reported partition metadata; disk modification or availability loss requires a separate downstream consumer to act on that metadata. This issue is fixed in 2.41.4.(CVE-2026-53615)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openeuler/util-linuxto a version that resolves this vulnerability.Fixed in 2.37.2-58.oe2203sp4 - Upgrade
Upgrade
util-linuxto a version that resolves this vulnerability.Fixed in 2.41.4
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Systems that probe crafted DOS extended-partition disk images or removable media are exposed. Exploitation is local and requires the malicious image or medium to be processed by libblkid.
What does an attacker need to do to exploit it?
An attacker needs to cause a crafted DOS extended-partition disk image or removable medium to be probed. No privileges or user interaction are required according to the supplied vector, but access is local.
What is the direct impact of successful exploitation?
libblkid can report a false partition that overlaps the MBR, compromising the integrity of reported partition metadata. Disk modification or availability impact requires a separate downstream consumer to act on that incorrect metadata.
Which versions contain the fix?
The issue is fixed in util-linux 2.41.4. Versions before 2.41.4 are described as affected.