VulnTideExploited vulnerabilities, by vendor. Data as of .
Not in CISA KEVReported exploited: VulnCheck KEV since Published CVSS 7.0 highEPSS 0.5% probability of exploitation in 30 days
Red Hat

CVE-2025-6019: Libblockdev: lpe from allow_active to root in libblockdev via udisks

Is it exploited?

Reported, not confirmed by CISA. VulnCheck KEV lists it as exploited in the wild. CISA has not added it to its Known Exploited Vulnerabilities catalog as of .

VulnCheck KEV lists it since . It cites 1 public report, the first from .

How likely is exploitation in the next 30 days?
0.5%

EPSS score, percentile 41.4 of all scored records. A probability estimated by FIRST, not a report of exploitation.

How severe?
7.0 High

CVSS v3.1 base score, given by the CNA

What should I do?

CISA has set no required action, because the vulnerability is not in KEV.

Advisories and patches (11)

Which versions are affected?

Unaffected 0:3.2.0-4.el10_0; 0:2.18-5.el7_9.1; 0:2.28-7.el8_10; 0:2.19-13.el8_2; 0:2.24-6.el8_4; 0:2.24-9.el8_6; and 7 more

Versions by product

Source: CISA KEV 2026.10.29, as of ; VulnCheck KEV, as of ; FIRST EPSS, as of ; CVE List, as of . About the data.

Description

Libblockdev: lpe from allow_active to root in libblockdev via udisks

A Local Privilege Escalation (LPE) vulnerability was found in libblockdev. Generally, the "allow_active" setting in Polkit permits a physically present user to take certain actions based on the session type. Due to the way libblockdev interacts with the udisks daemon, an "allow_active" user on a system may be able escalate to full root privileges on the target host. Normally, udisks mounts user-provided filesystem images with security flags like nosuid and nodev to prevent privilege escalation. However, a local attacker can create a specially crafted XFS image containing a SUID-root shell, then trick udisks into resizing it. This mounts their malicious filesystem with root privileges, allowing them to execute their SUID-root shell and gain complete control of the system.

Source: CVE List, as of . About the data.

What to do

Advisories and patches

Workaround (from the CVE record)

Currently, no mitigation is available for this vulnerability.

This summary is based on the CVE record as of . Check the vendor's advisory before you act: affected versions and fixes can change.

Affected products and versions

Versions by product, as listed in the CVE record (13 products)
Red Hat Red Hat Enterprise Linux 10
StatusVersions
Unaffected0:3.2.0-4.el10_0

Versions not listed are: affected.

Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support
StatusVersions
Unaffected0:2.18-5.el7_9.1

Versions not listed are: affected.

Red Hat Red Hat Enterprise Linux 8
StatusVersions
Unaffected0:2.28-7.el8_10

Versions not listed are: affected.

Red Hat Red Hat Enterprise Linux 8.2 Advanced Update Support
StatusVersions
Unaffected0:2.19-13.el8_2

Versions not listed are: affected.

Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
StatusVersions
Unaffected0:2.24-6.el8_4

Versions not listed are: affected.

Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
StatusVersions
Unaffected0:2.24-9.el8_6

Versions not listed are: affected.

Red Hat Red Hat Enterprise Linux 8.6 Telecommunications Update Service
StatusVersions
Unaffected0:2.24-9.el8_6

Versions not listed are: affected.

Red Hat Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
StatusVersions
Unaffected0:2.24-9.el8_6

Versions not listed are: affected.

Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
StatusVersions
Unaffected0:2.28-3.el8_8

Versions not listed are: affected.

Red Hat Red Hat Enterprise Linux 9
StatusVersions
Unaffected0:2.28-14.el9_6

Versions not listed are: affected.

Red Hat Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions
StatusVersions
Unaffected0:2.25-12.el9_0

Versions not listed are: affected.

Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
StatusVersions
Unaffected0:2.28-5.el9_2

Versions not listed are: affected.

Red Hat Red Hat Enterprise Linux 9.4 Extended Update Support
StatusVersions
Unaffected0:2.28-11.el9_4

Versions not listed are: affected.

Versions the record lists as unaffected: 0:3.2.0-4.el10_0, 0:2.18-5.el7_9.1, 0:2.28-7.el8_10, 0:2.19-13.el8_2, 0:2.24-6.el8_4, 0:2.24-9.el8_6, 0:2.28-3.el8_8, 0:2.28-14.el9_6.

Source: CVE List, as of . About the data.

Weakness

CWE-250

CWE and CAPEC are maintained by MITRE; the entries are those named in the CVE record.

Timeline

DateEvent
CVE record published
CVE record last updated

References

3

2 more in the CVE record.

Known exploited Red Hat vulnerabilities

  • CVE-2015-3246: Red Hat Libuser Race Condition Vulnerability (added )
  • CVE-2015-5287: Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability (added )
  • CVE-2018-14667: Red Hat JBoss RichFaces Framework Expression Language Injection Vulnerability (added )
  • CVE-2021-3560: Red Hat Polkit Incorrect Authorization Vulnerability (added )
  • CVE-2021-4034: Red Hat Polkit Out-of-Bounds Read and Write Vulnerability (added )