CVE-2026-13595 Util-linux: util-linux: heap use-after-free in libblkid nested partition probing
A heap use-after-free in libblkid allows attackers to cause information disclosure or denial of service via crafted block device images.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-13595?
CVE-2026-13595 is a medium-severity use after free vulnerability in Redhat Enterprise Linux, published on 29 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.
Weakness: CWE-416
Which versions are affected by CVE-2026-13595?
It affects 4 products.
Linux distribution packages (18)
libblkid Red Hat:hummingbird:1 | All versions | 0:2.42.2-1.hum1 |
libblkid-devel Red Hat:hummingbird:1 | All versions | 0:2.42.2-1.hum1 |
libfdisk Red Hat:hummingbird:1 | All versions | 0:2.42.2-1.hum1 |
libfdisk-devel Red Hat:hummingbird:1 | All versions | 0:2.42.2-1.hum1 |
liblastlog2 Red Hat:hummingbird:1 | All versions | 0:2.42.2-1.hum1 |
liblastlog2-devel Red Hat:hummingbird:1 | All versions | 0:2.42.2-1.hum1 |
libmount Red Hat:hummingbird:1 | All versions | 0:2.42.2-1.hum1 |
libmount-devel Red Hat:hummingbird:1 | All versions | 0:2.42.2-1.hum1 |
libsmartcols Red Hat:hummingbird:1 | All versions | 0:2.42.2-1.hum1 |
libsmartcols-devel Red Hat:hummingbird:1 | All versions | 0:2.42.2-1.hum1 |
libuuid Red Hat:hummingbird:1 | All versions | 0:2.42.2-1.hum1 |
libuuid-devel Red Hat:hummingbird:1 | All versions | 0:2.42.2-1.hum1 |
python3-libmount Red Hat:hummingbird:1 | All versions | 0:2.42.2-1.hum1 |
util-linux Red Hat:hummingbird:1 | All versions | 0:2.42.2-1.hum1 |
util-linux-core Red Hat:hummingbird:1 | All versions | 0:2.42.2-1.hum1 |
util-linux-i18n Red Hat:hummingbird:1 | All versions | 0:2.42.2-1.hum1 |
util-linux-script Red Hat:hummingbird:1 | All versions | 0:2.42.2-1.hum1 |
uuidd Red Hat:hummingbird:1 | All versions | 0:2.42.2-1.hum1 |
Products include Kernel Util-Linux, Redhat Enterprise Linux, Redhat Hardened Images, Redhat Openshift Container Platform.
How do I fix CVE-2026-13595?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-13595 being exploited?
There is no known exploitation of CVE-2026-13595 in the wild and no public exploit code.
Other vulnerabilities in Redhat Enterprise Linux
Sources
Also known as AZL-91581, BELL-CVE-2026-13595, CLSA-2026-1785510866, CLSA-2026-1787813016, DEBIAN-CVE-2026-13595, ECHO-7e3b-1e2a-0ee6 and 11 more.