mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-09-09 07:51:59 -09:00
d94c3fa54a
- CVE-2026-13595:
A flaw was found in the libblkid library of util-linux. During nested
partition probing, the BSD, Minix, Solaris x86, and UnixWare partition
probers cache a raw pointer to a parent partition entry in a
dynamically allocated array. When subsequent partition additions cause
the array to be reallocated, this pointer becomes stale, leading to a
heap use-after-free read. An attacker who can present a crafted block
device image (for example, via USB insertion or a loop-mounted disk
image) can trigger this flaw without user interaction, as libblkid is
invoked automatically by udev/udisks as root on block-device hot-plug
events. This could lead to limited information disclosure or denial of
service.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-13595
- c0186f14fb
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>