{"id":"CVE-2025-6019","title":"A Local Privilege Escalation (LPE) vulnerability was found in libblockdev","summary":"A Local Privilege Escalation (LPE) vulnerability was found in libblockdev. Generally, the \"allow_active\" setting in Polkit permits a physically present user to take certain actions based on the session type. Due to the way libblockdev in…","severity":"high","cvss":7,"cvssVector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-250"],"published":"2025-06-19","updated":"2026-06-25","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-6019","references":[{"url":"https://access.redhat.com/errata/RHSA-2025:10796","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2025:9320","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2025:9321","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2025:9322","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2025:9323","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2025:9324","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2025:9325","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2025:9326","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2025:9327","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2025:9328","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2025:9878","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/security/cve/CVE-2025-6019","label":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2370051","label":"secalert@redhat.com"},{"url":"https://cdn2.qualys.com/2025/06/17/suse15-pam-udisks-lpe.txt","label":"secalert@redhat.com"},{"url":"http://www.openwall.com/lists/oss-security/2025/06/17/5","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.openwall.com/lists/oss-security/2025/06/17/6","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.openwall.com/lists/oss-security/2025/06/18/1","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2025/06/msg00018.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://news.ycombinator.com/item?id=44325861","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.bleepingcomputer.com/news/linux/new-linux-udisks-flaw-lets-attackers-get-root-on-major-linux-distros/","label":"af854a3a-2127-422b-91ae-364da2661108"}],"tags":["nvd","exploit-available"],"epss":0.00469,"epssPercentile":0.39758,"ingestedAt":"2026-06-29T13:24:34.381Z","exploits":{"github":10,"githubRepos":["https://github.com/guinea-offensive-security/CVE-2025-6019","https://github.com/And-oss/CVE-2025-6019-exploit","https://github.com/neko205-mx/CVE-2025-6019_Exploit"],"checkedAt":"2026-09-23T07:13:37.511Z"},"exploitAvailable":true,"slug":"CVE-2025-6019","body":"## Overview\n\nA Local Privilege Escalation (LPE) vulnerability was found in libblockdev. Generally, the \"allow_active\" setting in Polkit permits a physically present user to take certain actions based on the session type. Due to the way libblockdev interacts with the udisks daemon, an \"allow_active\" user on a system may be able escalate to full root privileges on the target host. Normally, udisks mounts user-provided filesystem images with security flags like nosuid and nodev to prevent privilege escalation.  However, a local attacker can create a specially crafted XFS image containing a SUID-root shell, then trick udisks into resizing it. This mounts their malicious filesystem with root privileges, allowing them to execute their SUID-root shell and gain complete control of the system.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":51,"depthScoreParts":{"impact":38.5,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":4848,"id":"CVE-2025-6019","ts":1788887211616,"field":"exploit_available","old":"false","new":"true"},{"seq":3731,"id":"CVE-2025-6019","ts":1788886327764,"field":"exploit_available","old":"true","new":"false"},{"seq":2576,"id":"CVE-2025-6019","ts":1788883009295,"field":"exploit_available","old":"false","new":"true"},{"seq":1605,"id":"CVE-2025-6019","ts":1788882409182,"field":"exploit_available","old":"true","new":"false"},{"seq":716,"id":"CVE-2025-6019","ts":1788881846566,"field":"exploit_available","old":"false","new":"true"}]}