Moderate Security Vulnerability in util-linux Package: Heap Buffer Overread in setpwnam()
Summary
ALSA-2026:1696: Moderate: util-linux security update. Affects libblkid versions < 2.40.2-15.el10_1. Fixed in 2.40.2-15.el10_1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The util-linux package is a collection of essential low-level system utilities required for the operation of a Linux system. It includes tools such as fdisk for disk partitioning and the login program for user authentication. This package is critical for system management and functionality, making its security paramount.
Vulnerability Detail
The vulnerability identified as CVE-2025-14104 is a heap buffer overread in the setpwnam() function when processing usernames that are 256 bytes long. This flaw can potentially lead to information disclosure, allowing an attacker to read sensitive data from memory. The issue arises from improper handling of input data, which can be exploited if an attacker can control the username input.
How To Fix
Minimum fixed version
2.40.2-15.el10_1
This is the first release that contains the fix.
sudo dnf update libblkidTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, it is advisable to limit the length of usernames to below 256 bytes to mitigate the risk of exploitation until the package can be updated.
Conclusion
The util-linux package has a moderate security vulnerability (CVE-2025-14104) that can lead to information disclosure due to a heap buffer overread. It is crucial to update the package to the patched version to ensure system security. Users are encouraged to monitor their systems for vulnerabilities using tools like Vulert.
See every vulnerability recorded for libblkid →
FAQ
CVE-2025-14104 is a security vulnerability in the util-linux package that allows for a heap buffer overread, potentially leading to information disclosure.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability.
The primary risk is information disclosure, where sensitive data may be exposed to unauthorized users due to the buffer overread.
Yes, a patch is available in the form of an updated package version 2.40.2-15.el10_1. It is recommended to update to this version to mitigate the vulnerability.
If an immediate update is not possible, consider implementing a username length restriction to below 256 bytes as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for libblkid.
