A flaw was found in the libblkid library of util-linux

CVE-2026-13595 is a use-after-free (CWE-416) in libblkid, the partition/filesystem probing library shipped with util-linux and consumed by blkid, lsblk, udev/systemd-udevd, mount, and various installers. Triggering it requires the library to parse a maliciously crafted block device or image — nested partition tables, malformed superblocks, or a hand-rolled GPT/MBR header. Affected versions track the upstream util-linux tree (the disclosure points at current 2.39.x/2.40.x branches; distros will land backports in their util-linux packages — RHEL/CentOS, SUSE, Debian, Ubuntu).

Vendor scored this MEDIUM 6.8 with vector AV:L/AC:L/PR:N/UI:N/C:L/I:N/A:H. That A:H is doing all the heavy lifting and it's only fair if you assume udev or a privileged installer auto-probes attacker-supplied media. In the realistic enterprise case — server fleet, no USB autoprobe, no untrusted image mounts — the chain doesn't even start. 6.8 over-states risk for the typical host; LOW is the honest read.

Why this verdict

• Local vector caps reach: AV:L means no network attacker can ever touch this without a prior foothold.
• No integrity, no privilege gain: CVSS I:N and the absence of a published control-flow primitive limit the worst outcome to a crashed parser.
• Role multiplier — workstation/desktop with USB autoprobe: chain succeeds, blast radius is *one workstation's udevd crashing*; not fleet-scale.
• Role multiplier — server/cloud VM: chain does not start because there is no attacker-controlled block device path; this is the dominant deployment role.
• Role multiplier — multi-tenant container/Kubernetes host: chain only succeeds if you grant --privileged or expose raw block devices, which is a misconfiguration, not the default.
• No KEV, no in-the-wild, no weaponized PoC at T+1 day.

Why not higher?

Upgrading to MEDIUM or HIGH would require either a demonstrated path from UAF to code execution, or a network-reachable trigger. Neither exists. The vendor 6.8 leans on a udev-autoprobe worst case that doesn't reflect server fleets.

Why not lower?

Not IGNORE because forensic workstations, kiosks, and any host with udev USB autoprobe enabled do have a real (if niche) DoS exposure, and a UAF heap primitive could surprise us if a researcher weaponizes it. Track it; don't ignore it.

1. Disable udev autoprobe on servers and headless infrastructure — Mask systemd-udevd's automatic probing of hot-plugged block devices on hosts that have no business mounting USBs. There is no mitigation SLA for LOW — fold this into your standard hardening baseline within the 365-day remediation window.
2. Audit container runtimes for --privileged and raw block device passthrough — Tenants that can present a loopback device to a host-side blkid invocation are the only multi-tenant path to this bug. Review Kubernetes securityContext, Docker --device, and LXC profiles; remediate as normal hygiene.
3. Patch util-linux when your distro ships the fix — Pull apt/dnf/zypper updates in your standard monthly cadence. Per the noisgate remediation SLA for LOW, target ≤ 365 days; most defenders will get this in the next routine patch window.
4. Add a coredumpctl / journald alert for repeat systemd-udevd segfaults — Cheap detection. If someone is actually fuzzing libblkid against your hosts in the field, the udev workers will tell you.

Run on each Linux target host as any user (root not required for the version check). Example: ./check-cve-2026-13595.sh. Exits 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN. Update the FIXED_* variables once your distro publishes fixed package versions.

#!/usr/bin/env bash
# check-cve-2026-13595.sh — libblkid UAF (util-linux)
# Usage: ./check-cve-2026-13595.sh
set -u

# TODO: set these per-distro once vendor advisories publish fixed versions
FIXED_RHEL="2.37.4-99"   # placeholder
FIXED_DEB="2.40.2-1"     # placeholder
FIXED_SUSE="2.39.3-150600.99" # placeholder

result() { echo "$1"; exit "$2"; }

if ! command -v blkid >/dev/null 2>&1; then
  result "UNKNOWN: util-linux/blkid not installed" 2
fi

INSTALLED_VER=""
DISTRO_FAMILY="unknown"

if command -v rpm >/dev/null 2>&1; then
  DISTRO_FAMILY="rpm"
  INSTALLED_VER=$(rpm -q --qf '%{VERSION}-%{RELEASE}\n' util-linux-core 2>/dev/null || rpm -q --qf '%{VERSION}-%{RELEASE}\n' util-linux 2>/dev/null)
elif command -v dpkg-query >/dev/null 2>&1; then
  DISTRO_FAMILY="deb"
  INSTALLED_VER=$(dpkg-query -W -f='${Version}\n' util-linux 2>/dev/null)
fi

if [ -z "$INSTALLED_VER" ]; then
  result "UNKNOWN: could not determine util-linux version" 2
fi

echo "installed util-linux: $INSTALLED_VER ($DISTRO_FAMILY)"

# Crude version compare via dpkg --compare-versions / rpm -E
case "$DISTRO_FAMILY" in
  deb)
    if dpkg --compare-versions "$INSTALLED_VER" ge "$FIXED_DEB"; then
      result "PATCHED" 0
    else
      result "VULNERABLE" 1
    fi
    ;;
  rpm)
    # rpmdev-vercmp returns 11 if first < second, 12 if first > second, 0 if equal
    if command -v rpmdev-vercmp >/dev/null 2>&1; then
      rpmdev-vercmp "$INSTALLED_VER" "$FIXED_RHEL" >/dev/null
      rc=$?
      case $rc in
        0|12) result "PATCHED" 0 ;;
        11)   result "VULNERABLE" 1 ;;
        *)    result "UNKNOWN: rpmdev-vercmp rc=$rc" 2 ;;
      esac
    else
      # fall back to sort -V
      if [ "$(printf '%s\n%s\n' "$FIXED_RHEL" "$INSTALLED_VER" | sort -V | head -n1)" = "$FIXED_RHEL" ]; then
        result "PATCHED" 0
      else
        result "VULNERABLE" 1
      fi
    fi
    ;;
  *)
    result "UNKNOWN: unsupported distro family" 2
    ;;
esac

Sources

1. util-linux upstream (GitHub)
2. libblkid(3) manual page
3. Red Hat Bugzilla — historical libblkid issue example
4. CWE-416: Use After Free
5. CISA Known Exploited Vulnerabilities Catalog
6. FIRST EPSS
7. SUSE / openSUSE util-linux advisories (recent)
8. GitHub Advisory Database