A flaw was found in libblockdev's NTFS and VFAT filesystem plugins. The bd_fs_ntfs_set_label() and bd_fs_vfat_set_label() functions pass a caller-supplied label as a bare positional argument to the external ntfslabel and fatlabel binaries without a "--" end-of-options separator and without rejecting values that begin with "-". Because both tools use standard getopt-style option parsing, a label value that matches a recognized flag is interpreted as that flag instead of as literal label text.

This is reachable by any unprivileged local user with an active desktop session through udisks2's Filesystem.SetLabel() D-Bus method, which requires no administrator authentication for user-owned devices (polkit allow_active: yes for org.freedesktop.udisks2.modify-device).

Confirmed end-to-end: injecting "-f" as a label on a mounted NTFS device bypasses ntfslabel's mount-safety guard — the D-Bus method returns success but performs a query (no-op) instead of the requested label change. At the binary level, "--new-serial" causes ntfslabel to randomize the filesystem UUID (metadata corruption), though this was not reproducible through the D-Bus path due to ntfs-3g's exclusive device locking.

For VFAT, libblockdev's uppercasing of the label accidentally mitigates most fatlabel flags. The only surviving injection is "-v"/"-V" (version print, exit 0, no data change).

The vulnerability is classified as CWE-88 (Improper Neutralization of Argument Delimiters in a Command). The attack is local-only and limited to devices the user already has polkit authorization to modify. No RCE path or cross-user attack was identified.

Analysis was heavily AI-assisted.

Reported by: Yashashree Gund via PSIRTSUPT-25820.