CVE-2025-6019
HighCVSS 7.0Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
A Local Privilege Escalation (LPE) vulnerability was found in libblockdev. The 'allow_active' setting in Polkit allows a physically present user to take certain actions, and due to libblockdev's interaction with the udisks daemon, such a user can escalate to full root privileges. An attacker can create a crafted XFS image with a SUID-root shell and trick udisks into resizing it, mounting the malicious filesystem with root privileges.
Risk Assessment
The organization faces complete system compromise by a local user, potentially leading to data theft, malware installation, or further network attacks.
Recommendation
Immediately update libblockdev to the latest patched version and restrict physical access to systems to minimize the risk of exploitation by a local attacker.
Related vulnerabilities
- CVE-2026-100886Critical
A vulnerability was identified in Seetong T8108, T8108P, T8116 and T8232 version 4.6.1.4-build202604241011. The affected element is an unknown function of the Debug Service component, leading to improper authentication. The attack can be launched remotely and the exploit is publicly available.
- CVE-2026-101090Critical
Nezha 2.2.3 contains a Host header injection regression in the OAuth2 redirect endpoint. When the dashboard_host setting is empty, /api/v1/oauth2/{provider} reflects the attacker-supplied Host header into the redirect_uri. An attacker can steal the victim's authorization code and take over the account.
- CVE-2026-101084Critical
obot versions before v0.21.1 fail to enforce Access Control Rules on the /mcp-connect endpoint, allowing any authenticated user to connect to restricted MCP servers if they possess the server ID. Attackers can bypass authorization to access sensitive backend systems.
- CVE-2026-101065Critical
Obot up to commit d7e6970, when started via the Docker quickstart from README, listens on 0.0.0.0:8080 with authentication disabled. Every request is mapped to a synthetic 'nobody' user with Owner and Admin roles, granting full administrative access. The quickstart also mounts /var/run/docker.sock, giving access to the host's Docker control surface.
- CVE-2026-88773Critical
HTTP Request/Response Smuggling vulnerability in Citrix NetScaler ADC and Gateway due to inconsistent interpretation of HTTP requests.
- CVE-2026-88772CriticalActively exploited
Vulnerability in Citrix NetScaler ADC and Gateway leading to Remote Code Execution or Denial of Service.
- CVE-2026-88771CriticalActively exploited
Improper input validation in Citrix NetScaler ADC and Gateway allows an unauthenticated attacker to execute arbitrary commands.
- CVE-2026-100741Critical
Eval injection vulnerability in hMailServer (versions 6.0.0-6.3.3) allows a remote, unauthenticated attacker to execute arbitrary JScript in the service process with service account privileges. It requires non-default configuration: event scripting enabled, JScript as script language, and an OnClientValidatePassword handler defined. Exploitation uses a password with backslash and apostrophe that is not properly escaped.
- CVE-2026-100721Critical
A vulnerability in vm2 before 3.12.2 allows an authorization bypass in the NodeVM external-module resolver. When an embedder configures `require.external` with a custom resolver and `context: 'host'`, guest code can require an allowlisted module and then an absolute path of a non-allowlisted sibling sharing the resolved prefix. This leads to a sandbox escape and arbitrary code execution in the host process.
- CVE-2026-100740Critical
A vulnerability in D-Link DIR-895L A1_102b07 affects the tunnel_set_params function in tunnel.c of the L2TP Control Channel Parser component. Manipulation results in an out-of-bounds write. The attack can be initiated remotely, and the exploit is now public.
Original NVD description (English source)
A Local Privilege Escalation (LPE) vulnerability was found in libblockdev. Generally, the "allow_active" setting in Polkit permits a physically present user to take certain actions based on the session type. Due to the way libblockdev interacts with the udisks daemon, an "allow_active" user on a system may be able escalate to full root privileges on the target host. Normally, udisks mounts user-provided filesystem images with security flags like nosuid and nodev to prevent privilege escalation. However, a local attacker can create a specially crafted XFS image containing a SUID-root shell, then trick udisks into resizing it. This mounts their malicious filesystem with root privileges, allowing them to execute their SUID-root shell and gain complete control of the system.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS