CVE-2026-7867: 
Rocky Linux vulnerability analysis and mitigation

CVE-2026-7867 is a local privilege escalation vulnerability in udisks2, a daemon and toolkit for managing disk storage on Linux systems. The flaw exists in the org.freedesktop.UDisks2.Filesystem.Mount() D-Bus method, where insufficient authorization checking on the as-user option allows a local attacker with an active console session to spoof the parameter and mount filesystems on behalf of arbitrary users, including root. Affected versions are udisks2 >= 2.10.0; the patched version is 2.11.2. The vulnerability was reported on August 6, 2026, with a CVSS v3.1 base score of 7.8 (High) (Red Hat CVE, GitHub Advisory).

The root cause is a missing authorization check (CWE-862 / CWE-863) in the handle_mount D-Bus method handler within src/udiskslinuxfilesystem.c. The handler accepts a caller-controlled as-user option and resolves the specified username to a UID/GID via getpwnam_r() without verifying that the calling D-Bus client is authorized to impersonate that user. Specifically, the handle_mount_fstab sub-path conditionally skips the PolicyKit authorization check when fstab entries contain x-udisks-auth, user, or users mount options — and the attacker-controlled as-user value is passed directly into this unprotected code path. Exploitation requires only local D-Bus access (a standard logind session) and an fstab entry for a udisks2-visible block device with at least one of the above mount options, which is common on desktop Linux systems. A public PoC exploit (disk2root.sh) is available on GitHub (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation allows an unprivileged local user to mount attacker-controlled filesystem content under a target user's media directory (e.g., /run/media/root/), manipulate the mount namespace visible to privileged users, and ultimately achieve full local privilege escalation to root. The mount occurs with rw,relatime flags — notably without nosuid or noexec restrictions — enabling execution of SUID binaries placed on the attacker-controlled filesystem. This results in complete compromise of confidentiality, integrity, and availability of the affected system (GitHub Advisory, Red Hat CVE).

A functional, self-contained bash PoC exploit (disk2root.sh) is publicly available on GitHub, demonstrating privilege escalation from a low-privileged user (e.g., uid=1002) to root by exploiting the nosuid bypass and executing a SUID binary (Feedly). As of the time of reporting, there is no evidence of active in-the-wild exploitation; the NVD SSVC assessment lists exploitation as "none." The EPSS score is approximately 0.00175 (low probability of near-term exploitation). The vulnerability is not currently listed in the CISA KEV catalog. The vulnerability was discovered and reported by Azizcan Daştan (azqzazq1) and Özlem Ozan (oz7oz7) (Red Hat CVE).

1. Identify a qualifying fstab entry: Confirm the target system has an fstab entry for a udisks2-visible block device with x-udisks-auth, user, or users mount options (common on desktop Linux for removable media).
2. Prepare a malicious filesystem image: Create a filesystem image (e.g., ext2/ext4) containing a SUID root binary or payload (e.g., a copy of /bin/bash with the SUID bit set).
3. Associate the image with a loop device: Use losetup or similar tooling to attach the malicious image to a loop device visible to udisks2.
4. Invoke the D-Bus method with spoofed as-user: Call org.freedesktop.UDisks2.Filesystem.Mount() via D-Bus (e.g., using gdbus or dbus-send) with the as-user option set to root, bypassing PolicyKit authorization through the unprotected fstab mount path.
5. Trigger mount without nosuid restriction: The udisks2 daemon mounts the attacker-controlled filesystem under /run/media/root/ with rw,relatime and without nosuid/noexec flags.
6. Execute the SUID binary: Run the SUID binary from the mounted path to obtain a root shell, completing the local privilege escalation (GitHub Advisory, Feedly).

• D-Bus / System Logs: Entries in /var/log/syslog or journalctl showing udisksd mounting a filesystem with as-user=root (or another privileged account) initiated by a low-privileged user's session.
• File System: Unexpected mount points appearing under /run/media/root/ or other privileged user media directories; presence of SUID binaries in unusual locations such as loop-mounted directories.
• Process: Unusual processes spawned with effective UID 0 (root) from a non-root user's session; losetup invocations by non-root users creating loop devices with custom filesystem images.
• Audit Logs: auditd records showing mount syscalls with unexpected user context transitions; gdbus or dbus-send invocations targeting org.freedesktop.UDisks2.Filesystem.Mount with as-user parameters from low-privileged accounts.
• Network: No network-based IOCs expected for this local privilege escalation vulnerability.

The upstream fix is available in udisks2 version 2.11.2, released August 6, 2026 (udisks Release). Red Hat has issued security advisory RHSA-2026:53435 providing patched packages (udisks2-2.11.0-2.el10_2.1) for Red Hat Enterprise Linux 10 and its variants (Red Hat Errata). Debian has also issued a security update (DSA-6414-1). As interim mitigations: restrict console/local session access to trusted users only; review and harden D-Bus authorization policies for org.freedesktop.UDisks2.Filesystem.Mount() to enforce strict user validation; and audit fstab entries to remove or restrict user, users, and x-udisks-auth mount options where not required.

Red Hat classified this vulnerability as "Important" severity and credited researchers Azizcan Daştan (azqzazq1) and Özlem Ozan (oz7oz7) for the discovery (Red Hat CVE). The upstream udisks project published a GitHub Security Advisory (GHSA-j42g-v9jw-6ph3) with detailed technical analysis noting the vulnerability belongs to the same bug class as CVE-2026-26103 and CVE-2026-26104, discovered through systematic static auditing of D-Bus method handlers (GitHub Advisory). A YouTube video demonstrating the exploit was published shortly after disclosure, and coverage appeared across Linux security news outlets including linuxsecurity.com and pro-linux.de.