CVE-2026-53615
Published:October 14, 2026
Updated:October 15, 2026
util-linux is a random collection of Linux utilities. Before util-linux 2.41.4, "parse_dos_extended()" in "libblkid/src/partitions/dos.c" computes an extended-partition start sector with 32-bit addition and does not apply the extended-area bounds checks to the first two EBR entries. A local attacker who causes a crafted DOS extended-partition disk image or removable medium to be probed can wrap "cur_start + start" to sector zero and cause libblkid to report a false partition overlapping the MBR. This directly compromises the integrity of the reported partition metadata; disk modification or availability loss requires a separate downstream consumer to act on that metadata. This issue is fixed in 2.41.4.
Affected Packages
https://github.com/util-linux/util-linux.git (GITHUB):
Affected version(s) >=v2.39 <v2.41.4Fix Suggestion:
Update to version v2.41.4Related Resources (7)
Do you need more information?
Contact UsCVSS v4
Base Score:
7.1
Attack Vector
LOCAL
Attack Complexity
LOW
Attack Requirements
NONE
Privileges Required
NONE
User Interaction
NONE
Vulnerable System Confidentiality
LOW
Vulnerable System Integrity
HIGH
Vulnerable System Availability
HIGH
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
CVSS v3
Base Score:
8
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
LOW
Integrity
HIGH
Availability
HIGH
Weakness Type (CWE)
Integer Overflow or Wraparound