CVE-2026-13595: Util-linux: util-linux: heap use-after-free in libblkid nested partition probing
A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.
Other sources
A heap use-after-free vulnerability was found in libblkid's nested partition probing code in util-linux. The probebsdpt() function in libblkid/src/partitions/bsd.c caches a blkidpartition parent pointer into the partlist's heap-allocated parts[] array, then loops calling blkidpartlistaddpartition(), which may reallocarray() the same array. After reallocation, the stale parent pointer is dereferenced via blkidpartitiongetstart() — an 8-byte heap use-after-free read. The same dangling-pointer pattern exists in the minix, solarisx86, and unixware nested probers.
A crafted 2 MiB DOS/MBR disk image with three BSD-typed primaries (each holding >=16 slices) plus an md-raid 0.90 superblock triggers the issue via stock blkid -p. libblkid runs as root via udev/udisks on every block-device hot-plug event.
Upstream fix: https://github.com/util-linux/util-linux/commit/c0186f14fbdb02f64c8e0ba701ce727ea764ff4c
— Red Hat
Util-linux: util-linux: heap use-after-free in libblkid nested partition probing
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.40.2-5 - Upgrade
Upgrade
util-linux (libblkid)to a version that resolves this vulnerability.Patch c0186f14fbdb02f64c8e0ba701ce727ea764ff4c - Compensating control
Mitigate exploitability by preventing untrusted block-device images from being hot-plugged/added to systems that run udev/udisks calling libblkid as root (e.g., restrict allowed USB/block device sources or disable/block the udev/udisks hot-plug paths for untrusted devices).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-13595?
CVE-2026-13595 has a medium severity score of 6.8.
What vulnerability type is CVE-2026-13595 associated with?
CVE-2026-13595 is associated with the Use After Free vulnerability type.
How do I fix CVE-2026-13595?
To mitigate CVE-2026-13595, update util-linux to the latest version that addresses this vulnerability.
What systems are affected by CVE-2026-13595?
CVE-2026-13595 affects systems using the libblkid library in util-linux, particularly those utilizing BSD, Minix, Solaris x86, and UnixWare partition probers.
What impact does CVE-2026-13595 have?
The impact of CVE-2026-13595 includes a potential denial of service due to a heap use-after-free condition.