Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
3.3
CVE-2026-111581: Red Hat Enterprise Linux lets local users alter disk labels insecurely
CVE-2026-111581 · published 2 days ago
Summary
The libblockdev library used in Red Hat Enterprise Linux 7, 8, 9, and 10 allows anyone on the system to change the label of NTFS or FAT filesystems without proper checks. By giving a label that starts with a dash, an attacker can trick the underlying command into running unintended options, potentially bypassing security controls. Apply the latest vendor patches or update libblockdev to a version that validates label input.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| red hat | red hat enterprise linux 10 | All versions |
| red hat | red hat enterprise linux 7 | All versions |
| red hat | red hat enterprise linux 8 | All versions |
| red hat | red hat enterprise linux 9 | All versions |
Original advisory text
Libblockdev: libblockdev: argument injection in ntfs/vfat label-setting helpers via udisks2 setlabel() d-bus method
A flaw was found in libblockdev. The bd_fs_ntfs_set_label() and bd_fs_vfat_set_label() functions pass caller-supplied label values as bare positional arguments to the ntfslabel and fatlabel utilities without end-of-options separators or input validation for values beginning with a dash. This allows a label starting with '-' to be interpreted as a command-line flag by the spawned tool, potentially bypassing safety checks or causing unintended operations. This is reachable by unprivileged local users through the udisks2 Filesystem.SetLabel() D-Bus method without administrator authentication.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-88Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Timeline
Published16 Oct 2026
Updated17 Oct 2026
First seen16 Oct 2026
Track software like this
Free during beta