CVE-2026-13595: libblkid Heap Use-After-Free in Partition Probing (util-linux)

Technical summary

CVE-2026-13595 is a heap use-after-free vulnerability (CWE-416) in util-linux's libblkid partition-probing subsystem. The flaw exists in partition type handlers for BSD, Minix, Solaris x86, and UnixWare partition schemes. During nested partition discovery, a pointer to a parent partition entry is stored in a dynamically allocated array. When subsequent partition probing operations trigger array reallocation (due to capacity constraints), the stored pointer is not updated, remaining a stale reference to freed memory. Subsequent partition table parsing logic may dereference this invalid pointer, resulting in an out-of-bounds read from the heap. The vulnerability has a CVSS v3.1 score of 6.8 (Medium severity) with a vector reflecting local attack surface, no user interaction, and combined impact of limited confidentiality loss and high availability risk.

Business impact

Organizations relying on automatic block device mounting—common in containerized environments (OpenShift), storage management platforms, and multi-tenant systems—face operational risk. An attacker with physical access to a system (or network-accessible hot-plug capability in cloud scenarios) can craft a malicious disk image that, when inserted or mounted, triggers libblkid to leak kernel memory or crash the mounting daemon. This can disrupt workload scheduling, compromise secrets resident in kernel memory, or trigger denial-of-service cascades in orchestrated environments. For Red Hat Enterprise Linux deployments, this affects all versions shipped with vulnerable util-linux, potentially impacting critical infrastructure and compliance-sensitive workloads.

Affected systems

The vulnerability affects libblkid in util-linux across all Red Hat Enterprise Linux versions and Red Hat OpenShift Container Platform installations. It also impacts hardened container images distributed by Red Hat that include the vulnerable util-linux package. Any Linux system using libblkid for partition detection—including desktop environments with removable media support—is susceptible if the util-linux version is not patched. Systems relying on udev and udisks for automatic device management are at highest practical risk.

Exploitability

Exploitation is straightforward in access scenarios. An attacker needs only to create a malformed block device image (USB stick, disk image file, network-attached storage snapshot) and present it to a vulnerable system. No user interaction is required because udev and udisks automatically trigger libblkid parsing on hot-plug events with root privileges. The attack works offline (craft the image beforehand) or online (if network storage is involved). The low complexity and lack of authentication requirements classify this as a local-privilege or local-attacker vulnerability, though the automatic triggering path significantly lowers the barrier for opportunistic exploitation.

Remediation

Organizations should prioritize patching util-linux to a version that corrects the heap use-after-free flaw in partition probing logic. Red Hat will provide fixed packages through standard errata channels. For interim risk reduction, administrators can disable automatic block device mounting for untrusted media, restrict physical USB access, or enforce mandatory user approval for removable media—though these are detective or preventive measures rather than fixes. In containerized environments, ensure base images and node operating systems are updated synchronously to reduce the window of exposure.

Patch guidance

Contact your Red Hat support channel or monitor Red Hat's security advisories for util-linux patches addressing CVE-2026-13595. Patches will be made available for all affected Enterprise Linux versions. Test patches in non-production environments, particularly for container orchestration nodes, to verify that udev/udisks behavior and block device handling remain stable. Coordinate patching with your change management process, as util-linux updates may affect system boot, storage attachment, or device naming conventions in edge cases.

Detection guidance

Monitor system logs and udev/udisks activity for unexpected crashes or kernel memory-access violations (kernel OOps, segmentation faults) triggered during block device insertion. Intrusion detection signatures can be created to flag attempts to mount malformed or suspicious disk images in environments where hot-plug should not occur. On systems where automatic mounting is disabled, monitor for exploitation attempts via manual mount commands with crafted device images. Heap memory sanitizers (ASAN) or kernel debugging features (kasan) can detect the use-after-free at runtime in development and test environments.

Why prioritize this

Although the CVSS score is Medium (6.8), the automatic exploitation path—root privilege execution without user interaction—elevates practical risk in operational environments. OpenShift and container platforms that expose node storage to untrusted workloads or environments with physical security gaps should treat this with high priority. The combined impact of information disclosure (kernel memory leaks) and denial of service, coupled with the automatic trigger mechanism, justifies expedited patching for systems handling sensitive data or critical services. Non-containerized systems with restricted USB access and no automatic mounting can defer patching slightly longer but should not neglect it.

Risk score, explained

The CVSS 6.8 reflects: local attack vector (AV:L, physical device insertion), low complexity (AC:L, no special setup needed), no privileges required (PR:N, udev runs as root), no user interaction (UI:N, automatic triggering), unchanged scope (S:U), low confidentiality impact (C:L, limited memory disclosure), no integrity impact (I:N), and high availability impact (A:H, process crash or system instability). The score appropriately weights the automatic root-level triggering and availability risk, though it may understate risk in high-security, multi-tenant, or air-gapped environments where kernel memory disclosure is particularly sensitive.

Frequently asked questions