ZeroDay Findings
Sign inSign up

Findings

CVE-2026-53615

util-linux is a random collection of Linux utilities.

Published Oct 14, 2026 · updated Oct 14, 2026

util-linux is a random collection of Linux utilities. Before util-linux 2.41.4, in computes an extended-partition start sector with 32-bit addition and does not apply the extended-area bounds checks to the first two EBR entries. A local attacker who causes a crafted DOS extended-partition disk image or removable medium to be probed can wrap to sector zero and cause libblkid to report a false partition overlapping the MBR. This directly compromises the integrity of the reported partition metadata; disk modification or availability loss requires a separate downstream consumer to act on that metadata. This issue is fixed in 2.41.4.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 14, 2026 · NIST NVD

    Detected

    util-linux is a random collection of Linux utilities. Before util-linux 2.41.4, in computes an extended-partition start sector with 32-bit addition and does not apply the extended-area bounds checks to the first two EBR entries. A local attacker who causes a crafted DOS extended-partition disk image or removable medium to be probed can wrap to sector zero and cause libblkid to report a false parti

  2. Oct 14, 2026 · OSV.dev

    Fix available

    util-linux fixed in 2.41.5-0+deb13u1; util-linux fixed in 2.42-1

  3. Oct 14, 2026 · OSV.dev

    Fix available

    util-linux fixed in 2.41.5-0+deb13u1

  4. Oct 14, 2026 · OSV.dev

    Fix available

    util-linux fixed in 2.42-1

  5. Oct 14, 2026 · OSV.dev

    Updated

    util-linux is a random collection of Linux utilities. Before util-linux 2.41.4, in computes an extended-partition start sector with 32-bit addition and does not apply the extended-area bounds checks to the first two EBR entries. A local attacker who causes a crafted DOS extended-partition disk image or removable medium to be probed can wrap to sector zero and cause libblkid to report a false parti

Affected

  • Debian:12 util-linux2.38.1-5, 2.38.1-5+deb12u1, 2.38.1-5+deb12u2
  • Debian:13 util-linux0 → 2.41.5-0+deb13u1
  • Debian:14 util-linux0 → 2.42-1

Sources

  • CVE.orgCVE-2026-53615

    Official CVE identifier

    cve.org
  • NIST NVDCVE-2026-53615

    util-linux is a random collection of Linux utilities. Before util-linux 2.41.4, in computes an extended-partition start sector with 32-bit addition and does not apply the extended-area bounds checks to the first two EBR entri

    nvd.nist.gov
  • OSV.devDEBIAN-CVE-2026-53615
    osv.dev

References