CVE-2026-111581Low· 3.3▾ SunlitA flaw was found in libblockdev. The bd_fs_ntfs_set_label() and bd_fs_vfat_set_label() functions pass caller-supplied label values as bare positional arguments to the ntfslabel and fatlabel utilities without end-of-options separators or …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 18.2 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
A flaw was found in libblockdev. The bd_fs_ntfs_set_label() and bd_fs_vfat_set_label() functions pass caller-supplied label values as bare positional arguments to the ntfslabel and fatlabel utilities without end-of-options separators or input validation for values beginning with a dash. This allows a label starting with '-' to be interpreted as a command-line flag by the spawned tool, potentially bypassing safety checks or causing unintended operations. This is reachable by unprivileged local users through the udisks2 Filesystem.SetLabel() D-Bus method without administrator authentication.
libblockdev (all versions)libblockdev (all versions)libblockdev (all versions)libblockdev (all versions)Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
There is no practical mitigation that does not affect normal desktop functionality. Restricting the polkit policy for org.freedesktop.udisks2.modify-device to require administrator authentication (changing allow_active from "yes" to "auth_admin") would block the attack surface but would also require a password for all legitimate filesystem label and UUID operations on user-owned devices.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-104715High· 7.8Cifs-utils: mount.cifs credential-file option injection allows local privilege boundary bypass
CVE-2026-105326Low· 2.5An argument injection flaw was found in CUPS
CVE-2026-71464Low· 3.1LaunchConfigurationBaseSerializer.scm_branch has no validate_scm_branch() leading-dash check, unlike Project/JobTemplate/JobLaunch serializers
CVE-2026-71465Low· 3.1RunAdHocCommand.build_args() appends limit as bare positional (args.append(limit)) instead of using args.extend(['-l', limit]) like RunJob
CVE-2026-11332High· 7.8A flaw was found in ansible-core
CVE-2026-53783High· 8.1rsync before 3.5.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the rrsync restricted shell wrapper that allows authenticated clients to escape enforced directory restrictions by substituting a symlink…