CVE-2026-111581

A flaw was found in libblockdev. The bd_fs_ntfs_set_label() and bd_fs_vfat_set_label() functions pass caller-supplied label values as bare positional arguments to the ntfslabel and fatlabel utilities without end-of-options separators or input validation for values beginning with a dash. This allows a label starting with '-' to be interpreted as a command-line flag by the spawned tool, potentially bypassing safety checks or causing unintended operations. This is reachable by unprivileged local users through the udisks2 Filesystem.SetLabel() D-Bus method without administrator authentication.

An unprivileged local user can trigger unintended filesystem operations or bypass safety checks without administrator privileges. This may lead to data corruption or privilege escalation.

Update libblockdev to a version that includes input validation and end-of-options separators. Until then, consider restricting access to the udisks2 Filesystem.SetLabel() D-Bus method.