Missing Authorization in udisks - CVE-2026-7867

Vulnerability identifier: #VU141379

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-7867

CWE-ID: CWE-862

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to missing authorization in the Filesystem.Mount D-Bus method handler when processing a caller-controlled as-user option for fstab-managed block devices. A local user can supply a spoofed as-user value to escalate privileges.

Exploitation requires an fstab entry for a udisks2-visible block device with at least one of the x-udisks-auth, user, or users mount options.

udisks
Debian Linux
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Anolis OS
openEuler
Ubuntu
udisks2 (Ubuntu package)
udisks2-lvm2
udisks2-lsm
udisks2-debugsource
udisks2-debuginfo
udisks2-btrfs
libudisks2-devel
libudisks2
udisks2
udisks2 (Debian package)
udisks2-doc
udisks2-iscsi
udisks2 (Red Hat package)

Install security update from vendor's website.

udisks - update to 2.11.2
udisks2 (Ubuntu package) - addressed in versions 2.10.1-6ubuntu1.5, 2.10.91-1ubuntu2.1
udisks2-lvm2 - update to 2.10.1-10
udisks2-lsm - update to 2.10.1-10
udisks2-debugsource - update to 2.10.1-10
udisks2-debuginfo - update to 2.10.1-10
udisks2-btrfs - update to 2.10.1-10
libudisks2-devel - update to 2.10.1-10
libudisks2 - update to 2.10.1-10
udisks2 - update to 2.10.1-10
udisks2 (Debian package) - update to 2.10.1-12.1+deb13u2
udisks2-lvm2 - update to 2.10.90-7
udisks2-doc - update to 2.10.90-7
udisks2-lsm - update to 2.10.90-7
udisks2-iscsi - update to 2.10.90-7
udisks2 - update to 2.10.90-7
libudisks2-devel - update to 2.10.90-7
libudisks2 - update to 2.10.90-7
udisks2 (Red Hat package) - update to 2.11.0-2.el10_2.1

• https://github.com/storaged-project/udisks/security/advisories/GHSA-j42g-v9jw-6ph3

• Missing Authorization in udisks
• Debian update for udisks2
• Red Hat Enterprise Linux 10 update for udisks2
• openEuler 24.03 LTS SP4 update for udisks2
• openEuler 24.03 LTS SP3 update for udisks2
• openEuler 24.03 LTS SP1 update for udisks2
• Ubuntu update for udisks2
• Anolis OS update for udisks2