Critical Vulnerability in libblockdev: Local Privilege Escalation Risk
Summary
RLSA-2025:9328: Important: libblockdev security update. Affects libblockdev versions < 0:3.2.0-4.el10_0. Fixed in 0:3.2.0-4.el10_0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The libblockdev package provides a C library with GObject introspection support, facilitating low-level operations on block devices. It acts as a thin wrapper around various plug-ins for functionalities such as LVM, Btrfs, LUKS, and MD RAID. This package is essential for managing block devices efficiently, but it has been identified to have a significant security flaw.
Vulnerability Detail
The vulnerability, identified as CVE-2025-6019, allows for local privilege escalation (LPE) from an active user to root through the libblockdev library via udisks. This flaw can potentially allow unauthorized users to gain elevated privileges, compromising the integrity and security of the system. The CVSS score for this vulnerability is 7.0, indicating a high severity level.
How To Fix
Minimum fixed version
0:3.2.0-4.el10_0
This is the first release that contains the fix.
sudo dnf update libblockdevTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is advisable to apply the patch as soon as it becomes available to mitigate the risk.
Conclusion
The libblockdev package has a critical vulnerability (CVE-2025-6019) that allows local privilege escalation, which can severely compromise system security. It is essential to update to the patched version as soon as possible to mitigate this risk.
See every vulnerability recorded for libblockdev →
FAQ
libblockdev is a C library that provides support for low-level operations on block devices, including functionalities for LVM, Btrfs, LUKS, and MD RAID.
CVE-2025-6019 refers to a vulnerability in libblockdev that allows local privilege escalation from an active user to root, posing a significant security risk.
You can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file like package-lock.json. Visit Vulert Scanner to check your application without needing to sign up.
While there are no specific workarounds, it is crucial to prioritize updating the package to mitigate the risk of exploitation.
The CVSS score for this vulnerability is 7.0, indicating a high severity level that requires immediate attention.
Related vulnerabilities
Recent vulnerabilities recorded for libblockdev.
