CVE-2026-7867

Received Received - Intake

Udisks2 Local Privilege Escalation via Mount Namespace Spoofing

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: Red Hat, Inc.

Description

A flaw was found in udisks2. A local attacker with an active console session can exploit insufficient authorization checking on the 'as-user' option in the org.freedesktop.UDisks2.Filesystem.Mount() D-Bus method. This allows the attacker to spoof the 'as-user' parameter, mounting filesystems on behalf of arbitrary users, including privileged accounts. This can lead to local privilege escalation through mount point injection and manipulation of the mount namespace visible to privileged users.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-06

Last Modified

2026-08-06

Generated

2026-08-07

AI Q&A

2026-08-07

EPSS Evaluated

N/A

NVD

CVE-2026-7867

Affected Vendors & Products

Vendor	Product	Version / Range
freedesktop	udisks2	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability is in udisks2, a disk management tool. A local attacker with console access can exploit weak authorization in the org.freedesktop.UDisks2.Filesystem.Mount() D-Bus method. They can spoof the 'as-user' parameter to mount filesystems as any user, including privileged accounts. This enables local privilege escalation through mount point injection and namespace manipulation.

Detection Guidance

This vulnerability can be detected by checking for unauthorized filesystem mounts or suspicious D-Bus method calls. Review logs for org.freedesktop.UDisks2.Filesystem.Mount() usage with the 'as-user' parameter. Look for mounts performed by non-root users or unexpected mount points. Check system logs for D-Bus activity related to udisks2.

Impact Analysis

If exploited, this flaw allows an attacker to gain elevated privileges on your system. They could access sensitive data, install malware, or perform actions as a privileged user. Since it requires local console access, physical or authenticated remote access is needed to exploit it.

Mitigation Strategies

Update udisks2 to the latest patched version immediately. Restrict local console access to trusted users only. Monitor for unusual mount activities and unauthorized D-Bus method calls. Consider disabling the 'as-user' option in udisks2 configuration if not required.

Hi! I’m here to help you understand CVE-2026-7867. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70