OESA-2026-4577: util-linux security update
The util-linux package contains a random collection of files that implements some low-level basic linux utilities. Security Fix(es):
util-linux is a random collection of Linux utilities. Before util-linux 2.41.4, parsedosextended() in libblkid/src/partitions/dos.c computes an extended-partition start sector with 32-bit addition and does not apply the extended-area bounds checks to the first two EBR entries. A local attacker who causes a crafted DOS extended-partition disk image or removable medium to be probed can wrap curstart + start to sector zero and cause libblkid to report a false partition overlapping the MBR. This directly compromises the integrity of the reported partition metadata; disk modification or availability loss requires a separate downstream consumer to act on that metadata. This issue is fixed in 2.41.4.(CVE-2026-53615)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openeuler/util-linuxto a version that resolves this vulnerability.Fixed in 2.39.1-46.oe2403sp1 - Upgrade
Upgrade
util-linuxto a version that resolves this vulnerability.Fixed in 2.41.4