Local Privilege Escalation Vulnerability in Udisks2 Package
Summary
ALSA-2026:53435: Important: udisks2 security update. Affects libudisks2 versions < 2.11.0-2.el10_2.1.alma.2. Fixed in 2.11.0-2.el10_2.1.alma.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Udisks is a project that provides a daemon, tools, and libraries for accessing and manipulating disks and storage devices. It is widely used in various Linux distributions, including AlmaLinux. The Udisks2 package specifically allows users to manage storage devices and their configurations. However, it has been found to be vulnerable to a local privilege escalation issue, which could allow unauthorized users to gain elevated permissions.
Vulnerability Detail
The vulnerability identified as CVE-2026-7867 allows local users to exploit the 'as-user' option spoofing in the Udisks2 package. This can lead to unauthorized privilege escalation, enabling attackers to execute commands with higher privileges than intended. The impact of this vulnerability could range from unauthorized access to sensitive data to complete system compromise, depending on the attacker's capabilities and the system's configuration.
How To Fix
Minimum fixed version
2.11.0-2.el10_2.1.alma.2
This is the first release that contains the fix.
sudo dnf update libudisks2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict access to the Udisks2 functionality or limit the use of the 'as-user' option until the package is updated. This may involve modifying user permissions or disabling certain features that rely on Udisks2.
Conclusion
The Udisks2 package has a critical vulnerability that can lead to local privilege escalation. It is crucial for users to update to the patched version to safeguard their systems. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for libudisks2 →
FAQ
CVE-2026-7867 is a vulnerability in the Udisks2 package that allows local privilege escalation through option spoofing.
You can use the Vulert platform to check if your application is affected by this vulnerability. Visit Vulert Scanner to analyze your manifest file.
The risks include unauthorized access to sensitive data and potential system compromise, depending on the attacker's capabilities.
Yes, a patch is available in version 2.11.0-2.el10_2.1.alma.2 and later. Users should update to this version to mitigate the vulnerability.
If immediate updating is not possible, consider restricting access to Udisks2 functionalities or disabling the 'as-user' option as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for libudisks2.
