A heap use-after-free vulnerability was found in libblkid's nested partition probing code in util-linux. The probebsdpt() function in libblkid/src/partitions/bsd.c caches a blkidpartition parent pointer into the partlist's heap-allocated parts[] array, then loops calling blkidpartlistaddpartition(), which may reallocarray() the same array. After reallocation, the stale parent pointer is dereferenced via blkidpartitiongetstart() — an 8-byte heap use-after-free read. The same dangling-pointer pattern exists in the minix, solarisx86, and unixware nested probers.

A crafted 2 MiB DOS/MBR disk image with three BSD-typed primaries (each holding >=16 slices) plus an md-raid 0.90 superblock triggers the issue via stock blkid -p. libblkid runs as root via udev/udisks on every block-device hot-plug event.

Upstream fix: https://github.com/util-linux/util-linux/commit/c0186f14fbdb02f64c8e0ba701ce727ea764ff4c