---
id: CVE-2025-6019
title: A Local Privilege Escalation (LPE) vulnerability was found in libblockdev
summary: >-
  A Local Privilege Escalation (LPE) vulnerability was found in libblockdev.
  Generally, the "allow_active" setting in Polkit permits a physically present
  user to take certain actions based on the session type. Due to the way
  libblockdev in…
severity: high
cvss: 7
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-250
published: '2025-06-19'
updated: '2026-06-25'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-6019'
references:
  - url: 'https://access.redhat.com/errata/RHSA-2025:10796'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:9320'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:9321'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:9322'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:9323'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:9324'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:9325'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:9326'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:9327'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:9328'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:9878'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/security/cve/CVE-2025-6019'
    label: secalert@redhat.com
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2370051'
    label: secalert@redhat.com
  - url: 'https://cdn2.qualys.com/2025/06/17/suse15-pam-udisks-lpe.txt'
    label: secalert@redhat.com
  - url: 'http://www.openwall.com/lists/oss-security/2025/06/17/5'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://www.openwall.com/lists/oss-security/2025/06/17/6'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://www.openwall.com/lists/oss-security/2025/06/18/1'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://lists.debian.org/debian-lts-announce/2025/06/msg00018.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://news.ycombinator.com/item?id=44325861'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://www.bleepingcomputer.com/news/linux/new-linux-udisks-flaw-lets-attackers-get-root-on-major-linux-distros/
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
  - exploit-available
epss: 0.00469
epssPercentile: 0.39771
ingestedAt: '2026-06-29T13:24:34.381Z'
exploits:
  github: 10
  githubRepos:
    - 'https://github.com/guinea-offensive-security/CVE-2025-6019'
    - 'https://github.com/And-oss/CVE-2025-6019-exploit'
    - 'https://github.com/neko205-mx/CVE-2025-6019_Exploit'
  checkedAt: '2026-09-24T07:52:53.757Z'
exploitAvailable: true
---

## Overview

A Local Privilege Escalation (LPE) vulnerability was found in libblockdev. Generally, the "allow_active" setting in Polkit permits a physically present user to take certain actions based on the session type. Due to the way libblockdev interacts with the udisks daemon, an "allow_active" user on a system may be able escalate to full root privileges on the target host. Normally, udisks mounts user-provided filesystem images with security flags like nosuid and nodev to prevent privilege escalation.  However, a local attacker can create a specially crafted XFS image containing a SUID-root shell, then trick udisks into resizing it. This mounts their malicious filesystem with root privileges, allowing them to execute their SUID-root shell and gain complete control of the system.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.