A local privilege escalation vulnerability (CVE-2026-7867) with a CVSS score of 8.1 has been discovered in the udisks2 package, affecting its Filesystem.Mount D-Bus method. An unprivileged local user can potentially influence the mount execution path to perform a filesystem mount in a privileged/root context without expected PolicyKit authorization behavior, leading to business impact by allowing unauthorized access to system resources and compromising data integrity. This flaw type is an escalation of privilege vulnerability, accessible through a local attack vector, which could result in significant business disruption if exploited successfully.
We recommend you to upgrade udisks2 to version 2.10.1-12.1+deb13u2.[/subscribe_to_unlock_form]
A local privilege escalation vulnerability (CVE-2026-7867) with a CVSS score of 8.1 has been discovered in the udisks2 package, affecting its Filesystem.Mount D-Bus method. An unprivileged local user can potentially influence the mount execution path to perform a filesystem mount in a privileged/root context without expected PolicyKit authorization behavior, leading to business impact by allowing unauthorized access to system resources and compromising data integrity. This flaw type is an escalation of privilege vulnerability, accessible through a local attack vector, which could result in significant business disruption if exploited successfully.
We recommend you to upgrade udisks2 to version 2.10.1-12.1+deb13u2.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]