Bug 2554104 (CVE-2026-111581)

Summary: CVE-2026-111581 libblockdev: libblockdev: argument injection in NTFS/VFAT label-setting helpers via udisks2 SetLabel() D-Bus method
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: rhel-process-autobot, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in libblockdev. The bd_fs_ntfs_set_label() and bd_fs_vfat_set_label() functions pass caller-supplied label values as bare positional arguments to the ntfslabel and fatlabel utilities without end-of-options separators or input validation for values beginning with a dash. This allows a label starting with '-' to be interpreted as a command-line flag by the spawned tool, potentially bypassing safety checks or causing unintended operations. This is reachable by unprivileged local users through the udisks2 Filesystem.SetLabel() D-Bus method without administrator authentication.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-16 13:06:36 UTC 
A flaw was found in libblockdev's NTFS and VFAT filesystem plugins. The bd_fs_ntfs_set_label() and bd_fs_vfat_set_label() functions pass a caller-supplied label as a bare positional argument to the external ntfslabel and fatlabel binaries without a "--" end-of-options separator and without rejecting values that begin with "-". Because both tools use standard getopt-style option parsing, a label value that matches a recognized flag is interpreted as that flag instead of as literal label text.

This is reachable by any unprivileged local user with an active desktop session through udisks2's Filesystem.SetLabel() D-Bus method, which requires no administrator authentication for user-owned devices (polkit allow_active: yes for org.freedesktop.udisks2.modify-device).

Confirmed end-to-end: injecting "-f" as a label on a mounted NTFS device bypasses ntfslabel's mount-safety guard — the D-Bus method returns success but performs a query (no-op) instead of the requested label change. At the binary level, "--new-serial" causes ntfslabel to randomize the filesystem UUID (metadata corruption), though this was not reproducible through the D-Bus path due to ntfs-3g's exclusive device locking.

For VFAT, libblockdev's uppercasing of the label accidentally mitigates most fatlabel flags. The only surviving injection is "-v"/"-V" (version print, exit 0, no data change).

The vulnerability is classified as CWE-88 (Improper Neutralization of Argument Delimiters in a Command). The attack is local-only and limited to devices the user already has polkit authorization to modify. No RCE path or cross-user attack was identified.

Analysis was heavily AI-assisted.

Reported by: Yashashree Gund via PSIRTSUPT-25820.