CVE-2026-13595: libblkid Use-After-Free Vulnerability

CVE-2026-13595 Overview

CVE-2026-13595 is a heap use-after-free vulnerability [CWE-416] in the libblkid library of util-linux. The flaw resides in the nested partition probing logic used by the BSD, Minix, Solaris x86, and UnixWare partition probers. These probers cache a raw pointer to a parent partition entry stored in a dynamically allocated array. When subsequent partition additions trigger a reallocation of that array, the cached pointer becomes stale and later dereferenced.

An attacker who can present a crafted block device image, for example via USB insertion or a loop-mounted disk image, triggers the flaw without user interaction. libblkid runs automatically as root through udev and udisks on block-device hot-plug events.

Critical Impact
Attackers with physical or local access to a target Linux system can trigger a root-context use-after-free through automatic block-device probing, resulting in limited information disclosure or denial of service.

Affected Products

util-linuxlibblkid library (partition probing subsystem)
Red Hat Enterprise Linux distributions shipping affected util-linux builds
Linux systems using udev and udisks to auto-probe removable media

Discovery Timeline

2026-06-29 - CVE-2026-13595 published to NVD
2026-06-30 - Last updated in NVD database

Technical Details for CVE-2026-13595

Vulnerability Analysis

The defect lives in libblkid/src/partitions/partitions.c. The internal partition table structure stores partition entries in a contiguous, dynamically resized array. Nested partition probers for BSD, Minix, Solaris x86, and UnixWare disk labels retrieve a pointer to the parent partition entry, then continue adding child partitions to the same array.

When the array grows past capacity, the underlying allocator moves the buffer to a new address. The previously captured parent pointer still references the freed memory region. Subsequent reads through that stale pointer constitute a heap use-after-free.

Because libblkid is invoked automatically as root during hot-plug events, exploitation does not require an interactive login session. A locally-attached malicious block device is sufficient to reach the vulnerable code path.

Root Cause

The root cause is unsafe pointer caching across a reallocation boundary. The partition table stored entries directly in a blkid_partition array, and probers held raw pointers into it. The upstream fix changes storage from an array of entries to an array of pointers to entries, so growing the outer array no longer invalidates references held by nested probers.

Attack Vector

The attack vector is local. An attacker inserts a crafted USB device or convinces a privileged process to loop-mount a malicious disk image. udev and udisks invoke libblkid as root, which walks the crafted partition layout and triggers the stale pointer read. Successful triggering yields either kernel-adjacent heap memory disclosure or a process crash and denial of service.

// Patch: libblkid/src/partitions/partitions.c
// Change entry array to array of pointers so reallocation
// does not invalidate parent pointers held by nested probers.

	int		nparts;		/* number of partitions */
	int		nparts_max;	/* max.number of partitions */
-	blkid_partition	parts;		/* array of partitions */
+	blkid_partition	*parts;		/* array of pointers to partitions */

	struct list_head l_tabs;	/* list of partition tables */
};

Source: GitHub Commit c0186f14 for util-linux

Detection Methods for CVE-2026-13595

Indicators of Compromise

Unexpected crashes or segmentation faults in blkid, udevd, or udisksd processes shortly after a USB or loop-mount event.
Kernel or journald log entries showing libblkid aborts referencing BSD, Minix, Solaris, or UnixWare partition types.
Insertion of removable media containing unusual nested partition tables not matching normal user workflows.

Detection Strategies

Monitor udev and udisks process telemetry for abnormal termination or heap corruption signatures during block-device hot-plug events.
Track versions of the util-linux package across the fleet and flag hosts still running pre-patch builds.
Correlate USB insertion events with subsequent privileged process crashes to identify probing-based exploitation attempts.

Monitoring Recommendations

Enable auditd rules for udev rule execution and block-device attach events, capturing device serial and vendor metadata.
Ship syslog and journald output for udisksd, udevd, and blkid into a central log platform for anomaly review.
Alert on repeated libblkid-related crashes on the same host, which may indicate iterative exploitation attempts.

How to Mitigate CVE-2026-13595

Immediate Actions Required

Apply the vendor-provided util-linux update on all affected Linux hosts, prioritizing multi-user systems and endpoints with physical USB exposure.
Restrict physical access to workstations, servers, and kiosks that auto-mount removable media.
Disable automatic mounting of untrusted block devices where operationally feasible until patches are deployed.

Patch Information

The upstream fix is committed to util-linux in commit c0186f14fbdb02f64c8e0ba701ce727ea764ff4c, which changes the partition entry array to an array of pointers so reallocation no longer invalidates cached parent references. Red Hat has published fixes through Red Hat Security Advisory RHSA-2026:26573 and additional guidance at Red Hat CVE-2026-13595 Details. Downstream tracking is available in Red Hat Bug Report #2494101.

Workarounds

Mask or disable the udisks2 service on servers that do not need removable media support: systemctl mask udisks2.
Configure udev rules to ignore untrusted USB storage devices on high-value systems until patching completes.
Enforce USB port control policies through endpoint management tooling to block unauthorized block-device insertion.

bash

# Update util-linux on Red Hat based systems
sudo dnf update util-linux libblkid --refresh

# Verify installed version
rpm -q util-linux libblkid

# Optional: disable automatic block device handling on servers
sudo systemctl mask udisks2.service
sudo systemctl restart systemd-udevd