CVE-2026-111581

A flaw was found in libblockdev. The bd_fs_ntfs_set_label() and bd_fs_vfat_set_label() functions pass caller-supplied label values as bare positional arguments to the ntfslabel and fatlabel utilities without end-of-options separators or input validation for values beginning with a dash. This allows a label starting with '-' to be interpreted as a command-line flag by the spawned tool, potentially bypassing safety checks or causing unintended operations. This is reachable by unprivileged local users through the udisks2 Filesystem.SetLabel() D-Bus method without administrator authentication.

Red Hat has assessed this as Low severity. The argument injection allows an unprivileged local user to cause ntfslabel or fatlabel to interpret a crafted label value as a command-line flag, but the practical impact is limited: the user can only affect devices they already have polkit authorization to modify, the proven end-to-end impact through the D-Bus API is a no-op where SetLabel() returns success without performing the requested label change, and no data corruption, privilege escalation, or cross-user attack was demonstrated through the D-Bus path.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

There is no practical mitigation that does not affect normal desktop functionality. Restricting the polkit policy for org.freedesktop.udisks2.modify-device to require administrator authentication (changing allow_active from "yes" to "auth_admin") would block the attack surface but would also require a password for all legitimate filesystem label and UUID operations on user-owned devices.