udisks2 Filesystem.Mount D-Bus Method Accepts a Spoofed as-user Parameter, Enabling Mount Point Injection and Local Privilege Escalation
Last refreshed2026-11-05
Status: UPDATED
| Advisory ID: CVE-2026-7867
Key Details
CVE
CVE-2026-7867
CVSS Score / Version
7.8 (High) / CVSS v3.1
Updated
2026-11-05
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS Prose
attack vector is local; attack complexity is low; privileges required is low; user interaction is none; scope is unchanged; confidentiality impact is high; integrity impact is high; availability impact is high.
Affected products
Red Hat Enterprise Linux 10 and Red Hat Enterprise Linux 10.0 Extended Update Support
Classified as
CWE-863 (Incorrect Authorization)
Affected Products, Subsystems & Sectors
Vendor
Product
Affected Versions
Patch Status
Red Hat
Red Hat Enterprise Linux 10
Red Hat
Red Hat Enterprise Linux 10.0 Extended Update Support
Subsystems
OT Supporting Infrastructure
Sectors
Multiple
What to Know
A flaw was found in udisks2. A local attacker with an active console session can exploit insufficient authorization checking on the 'as-user' option in the org.freedesktop.UDisks2.Filesystem.Mount() D-Bus method. This allows the attacker to spoof the 'as-user' parameter, mounting filesystems on behalf of arbitrary users, including privileged accounts. This can lead to local privilege escalation through mount point injection and manipulation of the mount namespace visible to privileged users. (NVD)
What to Do
Monitor Red Hat's web page for any future patch releases.