CVE-2026-7867: Local Privilege Escalation in udisks2 via as-user Option Spoofing

Vulnerability Overview Vulnerability Name: Local Privilege Escalation in udisks2 via as-user Option Spoofing in Filesystem.Mount CVE ID: CVE-2026-7867 CVSS v3 Base Metrics: Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High CVSS Score: 7.8 (High) Vulnerability Description: A local privilege escalation vulnerability exists in udisks2, allowing any unprivileged local user to mount block devices managed via fstab as root without Polkit authorization. This vulnerability resides in the D-Bus method handler, which accepts an option to override the caller's identity without verifying authorization. When combined with fstab entries containing , , or mount options, this leads to a complete bypass of the Polkit authorization mechanism. Impact Scope Affected Versions: >= 2.10.0 Fixed Version: 2.11.2 Vulnerability Category: - Missing Authorization Check (CVE-862) - Improper Privilege Management (CVE-269) Impact: Local Privilege Escalation (LPE) - Unprivileged Local User -> Root Attack Complexity: Low Prerequisites: - An fstab entry for a block device visible to udisks2, containing at least one of , , or mount options. - This is common on desktop Linux systems with removable media. Remediation Fixed Version: 2.11.2 Vulnerability Details Root Cause The D-Bus method handler ( ) accepts an option within the method call parameters. This option is intended to allow a privileged caller to mount a file system on behalf of another user. However, the handler resolves the username to UID/GID using without verifying whether the D-Bus caller is authorized to impersonate the specified user. Impact Analysis Direct Impact An unprivileged local user can mount any fstab-managed block device (with , , or options) as root without any authorization prompt. The mount is performed using —apparently lacking or restrictions. Prerequisites Required: An fstab entry for a block device visible to udisks2, containing at least one of , , or mount options. Required: Local session D-Bus access (by default, any local user has this, unless modified in a standard Linux desktop/server installation). Not Required: Physical access (if a qualifying fstab entry exists), network access, or any prior privileges. Discovery Methodology This vulnerability was discovered during a systematic static audit of udisks2's D-Bus method handlers, searching for methods lacking Polkit authorization checks—specifically targeting the same vulnerability category (CVE-2026-26102 and CVE-2026-26104) as two vulnerabilities that were fixed on 2026-02-13, both titled "Add missing polkit checks". The audit methodology was as follows: 1. Static Detection: For each D-Bus method handler in and , check if its body calls any of the following: , , , or the macro. 2. False Positive Filtering: Eliminate handlers that delegate authorization to helpers ( , , , etc.). 3. Path-Sensitive Analysis: For handlers that do have authorization checks, trace all code paths to determine if they are covered or if conditional branches can skip the check. Step 3 revealed this vulnerability: has a Polkit check on most paths, but the sub-path conditionally skips it based on fstab mount options—and the caller-controlled option allows spoofing the identity for entry into the unprotected path. Additional Information Reporter: tbaztek Disclosure Date: 2026 (Specific date not provided) Repository: stored-project/udisks2 Tags: Security / Advisories / GHSA-j42g-v9jw-6ph3

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-7867: Local Privilege Escalation in udisks2 via as-user Option Spoofing

More from this source