CVE-2026-53615

A flaw was found in util-linux. An integer overflow vulnerability in the partition parsing library (libblkid) fails to properly enforce boundary checks on extended partition entries. A local attacker could exploit this flaw by presenting a crafted disk image or removable storage device for probing, causing false partition boundaries to be reported that overlap the Master Boot Record (MBR). This directly compromises the integrity of reported disk partition metadata and may result in unintended data corruption if downstream system tools act on the incorrect layout.

Red Hat rated this flaw IMPORTANT with CVSS 3.1 score 8.0 (AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H), consistent with the upstream assessment. Red Hat Enterprise Linux 7, 8, 9, and 10, Red Hat In-Vehicle OS, OpenShift Container Platform 4 and 5 (through the rhcos component), Red Hat Hardened Images, and Ansible Services are affected, and a fix is being pursued for these products. The golangci-lint container in Hosted OpenShift is not affected because the vulnerable code is not present.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Red Hat is not aware of a practical temporary workaround that fully mitigates this issue or meets Red Hat Product Security's standards for usability, deployment, applicability, or stability. Customers are advised to apply the relevant security updates when/if they become available.