CVE-2026-13595: 
NixOS vulnerability analysis and mitigation

CVE-2026-13595 is a heap use-after-free vulnerability in the libblkid library of util-linux, affecting its nested partition probing code. During partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array; when subsequent partition additions trigger a reallocarray(), the cached pointer becomes stale, resulting in an 8-byte heap use-after-free read. The vulnerability affects util-linux versions prior to 2.42.2, as well as Red Hat Enterprise Linux 7.0–10.0 and OpenShift Container Platform 4.0–4.22.1. It was disclosed on June 29, 2026, with a CVSS v3.1 base score of 6.8 (Medium) per the GitHub Advisory Database, or 5.3 (Medium) per NVD (Github Advisory, Red Hat Bugzilla).

The root cause is a use-after-free (CWE-416) in libblkid/src/partitions/partitions.c. The probe_bsd_pt() function (and analogous functions for Minix, Solaris x86, and UnixWare) caches a blkid_partition parent pointer referencing an entry in the partlist's heap-allocated parts[] array. When blkid_partlist_add_partition() is called repeatedly and the array is grown via reallocarray(), the old pointer becomes dangling; subsequent dereference via blkid_partition_get_start() constitutes an 8-byte heap use-after-free read. A crafted 2 MiB DOS/MBR disk image with three BSD-typed primaries (each holding ≥16 slices) plus an md-raid 0.90 superblock is sufficient to trigger the flaw via blkid -p. The upstream fix, committed by Karel Zak and reported by Thai Duong, changes the partition storage from an array of structs to an array of pointers (each individually allocated via calloc()), making all blkid_partition pointers stable across reallocations (Red Hat Bugzilla, util-linux commit).

Successful exploitation can result in limited heap memory disclosure (confidentiality impact) or a denial of service via process crash (availability impact). Because libblkid is invoked automatically by udev/udisks as root on every block-device hot-plug event, the vulnerability is triggered in a privileged context without requiring user interaction. There is no integrity impact, and lateral movement potential is limited; however, memory disclosure in a root-context process could theoretically expose sensitive kernel or process data (Github Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.13% (NVD) to 0.112% (GitHub Advisory), placing it in the low-risk percentile for near-term exploitation. Exploitation requires local access (e.g., physical USB insertion or the ability to mount a loop device) and high attack complexity, limiting the practical attacker pool (Github Advisory, Red Hat Bugzilla).

1. Craft a malicious disk image: Create a 2 MiB DOS/MBR disk image containing three BSD-typed primary partitions, each configured with ≥16 BSD slices, plus an md-raid 0.90 superblock. This layout forces libblkid to repeatedly call blkid_partlist_add_partition(), triggering multiple reallocarray() expansions of the partition array.
2. Deliver the image: Present the crafted image to the target system either by inserting a USB drive containing the image or by mounting it as a loop device (e.g., losetup /dev/loop0 crafted.img).
3. Trigger automatic probing: On block-device hot-plug, udev/udisks automatically invokes libblkid as root. Alternatively, manually trigger probing with blkid -p /dev/loop0 or udevadm trigger.
4. Achieve use-after-free: During nested partition probing, the stale parent pointer is dereferenced after reallocarray() moves the array, resulting in an 8-byte heap use-after-free read — potentially disclosing heap memory contents or crashing the blkid/udisks process (Red Hat Bugzilla, util-linux commit).

• File System: Presence of unusual or crafted disk image files (e.g., .img files with DOS/MBR layout containing BSD, Minix, Solaris x86, or UnixWare partition types) in user-accessible directories or on removable media.
• Logs: Unexpected crashes or segmentation faults in udisksd, udevd, or blkid processes recorded in /var/log/syslog, /var/log/messages, or journalctl; kernel messages (dmesg) referencing memory errors during partition probing.
• Process: Abnormal termination of udisks2 or udev worker processes shortly after a block device is connected or a loop device is mounted; core dumps from blkid or udisksd in /var/lib/systemd/coredump/ or /tmp/.
• Network: No network-based IOCs are expected, as this is a local attack vector.

The upstream fix is available in util-linux version 2.42.2 (commit c0186f14fbdb02f64c8e0ba701ce727ea764ff4c). Red Hat has released security advisory RHSA-2026:26573, providing updated RPMs (libblkid-2.42.2-1.hum1 and related packages) for Red Hat Hardened Images on aarch64 and x86_64. Administrators should update util-linux to 2.42.2 or later as the primary remediation. As interim mitigations, consider restricting physical access to USB ports, limiting unprivileged users' ability to mount loop devices (e.g., via udev rules or udisks policies), and monitoring for unexpected blkid/udisksd crashes (Red Hat Advisory, util-linux commit).

The vulnerability was reported by Thai Duong and fixed by Karel Zak (util-linux maintainer) via an upstream commit. Red Hat filed a Bugzilla entry and issued a security advisory (RHSA-2026:26573) promptly after disclosure. No significant broader media coverage or notable social media commentary has been identified beyond standard CVE aggregator entries (Red Hat Bugzilla, Red Hat Advisory).