CVE-2025-6019

CVE Enrichment

CVSS: 7.0 HIGH
EPSS: 0.47%
EPSS Percentile: 39.29%
CISA KEV: Not listed

Description

A Local Privilege Escalation (LPE) vulnerability was found in libblockdev. Generally, the "allow_active" setting in Polkit permits a physically present user to take certain actions based on the session type. Due to the way libblockdev interacts with the udisks daemon, an "allow_active" user on a system may be able escalate to full root privileges on the target host. Normally, udisks mounts user-provided filesystem images with security flags like nosuid and nodev to prevent privilege escalation. However, a local attacker can create a specially crafted XFS image containing a SUID-root shell, then trick udisks into resizing it. This mounts their malicious filesystem with root privileges, allowing them to execute their SUID-root shell and gain complete control of the system.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: secalert@redhat.com
Published: 19-Jun-2025 19:15
Last Modified: 30-Jun-2026 18:16
EPSS Date: 2026-10-20
CWE: CWE-250

CVSS Vector


            CVSS:3.1                            AV:L /
                            AC:H /
                            PR:L /
                            UI:N /
                            S:U /
                            C:H /
                            I:H /
                            A:H

References

Last enrichment sync: 21-Oct-2026 15:07
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

At the bottom of the list, the Linux libblockdev CVE-2025-6019 vulnerability, a high-severity local privilege Picus Blue Report 2026 Finds Enterprise Defenses Block Just 37% of Post-Compromise Actions

CVE (9)

Malware (10)

Threat Actors (10)

MITRE ATT&CK (15)

Vendors (1)

Products (16)

Tools (3)

Industries (10)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.