CVE-2026-7867 Details

A local privilege escalation vulnerability has been identified in udisks2, specifically in versions 2.10.0 and later. The issue arises from inadequate authorization checks on the 'as-user' option in the org.freedesktop.UDisks2.Filesystem.Mount() D-Bus method. This flaw allows a local attacker with an active console session to spoof the 'as-user' parameter, enabling the mounting of filesystems on behalf of any user, including those with privileged accounts. The exploitation of this vulnerability can lead to unauthorized manipulation of the mount namespace for privileged users and injection of malicious content into mount points, potentially escalating privileges.

Users can upgrade to udisks2 version 2.11.2, which addresses this vulnerability by implementing the necessary authorization checks. The updated version is available for download from the Red Hat Enterprise Linux 10 repository.