CVE-2026-7867

NameCVE-2026-7867
DescriptionLocal privilege escalation via as-user mount spoofing
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDSA-6414-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
udisks2 (PTS)bullseye2.9.2-2+deb11u1fixed
bullseye (security)2.9.2-2+deb11u3fixed
bookworm (security), bookworm2.9.4-4+deb12u2fixed
trixie (security), trixie2.10.1-12.1+deb13u1vulnerable
forky, sid2.11.1-2vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
udisks2sourcebullseye(not affected)
udisks2sourcebookworm(not affected)
udisks2sourcetrixie2.10.1-12.1+deb13u2DSA-6414-1
udisks2source(unstable)2.11.2-1

Notes

[bookworm] - udisks2 <not-affected> (udisks2 versions < 2.10.x are not affected)
[bullseye] - udisks2 <not-affected> (udisks2 versions < 2.10.x are not affected)
https://github.com/storaged-project/udisks/security/advisories/GHSA-j42g-v9jw-6ph3

Search for package or bug name: Reporting problems