Moderate Vulnerability in util-linux Package: Heap Buffer Overread in setpwnam()
Summary
ALSA-2026:1852: Moderate: util-linux security update. Affects libblkid versions < 2.32.1-48.el8_10. Fixed in 2.32.1-48.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The util-linux package is a collection of essential low-level system utilities required for the proper functioning of a Linux system. It includes tools such as fdisk for disk partitioning and the login program for user authentication. This package is critical for system operations and management, making its security paramount.
Vulnerability Detail
A heap buffer overread vulnerability exists in the util-linux package, specifically in the setpwnam() function when processing 256-byte usernames. This flaw, identified as CVE-2025-14104, can lead to potential information disclosure, allowing attackers to read sensitive data from memory that should not be accessible. The vulnerability arises from improper handling of user input, which can be exploited if an attacker provides a specially crafted username.
How To Fix
Minimum fixed version
2.32.1-48.el8_10
This is the first release that contains the fix.
sudo dnf update libblkidTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit the use of the affected utilities or restrict access to the system until the package is updated. However, the most effective solution is to apply the patch as soon as possible.
Conclusion
The util-linux package has a moderate vulnerability that can lead to information disclosure due to a heap buffer overread in the setpwnam() function. It is crucial for users to update their packages to the latest patched versions to mitigate this risk and ensure system security.
See every vulnerability recorded for libblkid →
FAQ
The vulnerability is a heap buffer overread in the setpwnam() function, which can lead to information disclosure.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Update the util-linux package and all related packages to the patched version 2.32.1-48.el8_10 or later.
Yes, you can limit the use of affected utilities or restrict access to the system as a temporary measure.
More details can be found on the CVE page for CVE-2025-14104, which provides insights into the impact and technical specifics.
Related vulnerabilities
Recent vulnerabilities recorded for libblkid.
