CVE-2026-111581 Libblockdev: libblockdev: argument injection in ntfs/vfat label-setting helpers via udisks2 setlabel() d-bus method
Unprivileged local users can inject command-line flags into ntfslabel or fatlabel via udisks2, potentially bypassing safety checks or modifying data.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-111581?
CVE-2026-111581 is a low-severity command injection vulnerability in Red Hat Enterprise Linux 10, published on 16 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A flaw was found in libblockdev. The bd_fs_ntfs_set_label() and bd_fs_vfat_set_label() functions pass caller-supplied label values as bare positional arguments to the ntfslabel and fatlabel utilities without end-of-options separators or input validation for values beginning with a dash. This allows a label starting with '-' to be interpreted as a command-line flag by the spawned tool, potentially bypassing safety checks or causing unintended operations. This is reachable by unprivileged local users through the udisks2 Filesystem.SetLabel() D-Bus method without administrator authentication.
Weakness: CWE-88
Which versions are affected by CVE-2026-111581?
How do I fix CVE-2026-111581?
No fix has been published for CVE-2026-111581 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-111581 being exploited?
There is no known exploitation of CVE-2026-111581 in the wild and no public exploit code.
Sources
Also known as AZL-109733, DEBIAN-CVE-2026-111581, GHSA-frq2-q7f6-4x3m, UBUNTU-CVE-2026-111581.