CVE-2026-53615

Awaiting Analysis Awaiting Analysis - Queue

Integer Overflow in util-linux libblkid Partition Parsing

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: GitHub, Inc.

Description

util-linux is a random collection of Linux utilities. Before util-linux 2.41.4, `parse_dos_extended()` in `libblkid/src/partitions/dos.c` computes an extended-partition start sector with 32-bit addition and does not apply the extended-area bounds checks to the first two EBR entries. A local attacker who causes a crafted DOS extended-partition disk image or removable medium to be probed can wrap `cur_start + start` to sector zero and cause libblkid to report a false partition overlapping the MBR. This directly compromises the integrity of the reported partition metadata; disk modification or availability loss requires a separate downstream consumer to act on that metadata. This issue is fixed in 2.41.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-53615

EUVD

EUVD-2026-101292

Affected Vendors & Products

Vendor	Product	Version / Range
util-linux	util-linux	< 2.41.4

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-190	The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

Attack-Flow Graph

Executive Summary

CVE-2026-53615 is a vulnerability in util-linux's libblkid library affecting versions before 2.41.4. It involves a uint32_t integer overflow in the parse_dos_extended() function when processing DOS extended partitions. The function fails to validate the first two Extended Boot Record (EBR) entries, allowing crafted disk images to manipulate partition metadata. Specifically, the calculation cur_start + start can wrap around to zero due to overflow, causing libblkid to register a fake partition at sector 0 (the MBR).

This compromises partition metadata integrity, potentially leading downstream tools like mkfs to overwrite the MBR or partition table when processing the fake partition.

Detection Guidance

To detect this vulnerability, check the util-linux version on your system using 'util-linux --version' or 'dpkg -l | grep util-linux' (Debian/Ubuntu) or 'rpm -qa | grep util-linux' (RHEL/CentOS). If the version is below 2.41.4, the system is vulnerable.

Impact Analysis

This vulnerability can lead to severe consequences such as disk corruption, data loss, or system unavailability. If exploited, it may cause the MBR or partition table to be overwritten when automated tools like mkfs process the fake partition. This can happen without user interaction in environments like cloud systems, CI/CD pipelines, or Kubernetes volumes.

An attacker could craft a malicious disk image or removable medium that triggers this issue, potentially making the disk unbootable or inaccessible. The attack requires no privileges and can be triggered remotely in logical or physical proximity.

Compliance Impact

This vulnerability could indirectly impact compliance with GDPR and HIPAA by compromising data integrity and availability. A crafted disk image could cause libblkid to report false partitions, leading to unintended disk modifications (e.g., MBR corruption) via downstream tools like mkfs. This may result in data loss or system unavailability, violating integrity and availability requirements under GDPR (Article 32) and HIPAA (Security Rule). However, the primary impact is on system integrity rather than direct data exposure.

Mitigation Strategies

Upgrade util-linux to version 2.41.4 or later immediately. Use your package manager: 'sudo apt-get update && sudo apt-get install util-linux' (Debian/Ubuntu) or 'sudo yum update util-linux' (RHEL/CentOS). Avoid inserting untrusted removable media until patched.

Hi! I’m here to help you understand CVE-2026-53615. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70