AZL-108198

See a problem?
Import Source
https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-108198.json
JSON Data
https://api.osv.dev/v1/vulns/AZL-108198
Upstream
Published
2026-10-14T16:17:46Z
Modified
2026-10-15T14:17:17Z
Summary
CVE-2026-53615 affecting package util-linux 2.40.2-6
Details

util-linux is a random collection of Linux utilities. Before util-linux 2.41.4, parse_dos_extended() in libblkid/src/partitions/dos.c computes an extended-partition start sector with 32-bit addition and does not apply the extended-area bounds checks to the first two EBR entries. A local attacker who causes a crafted DOS extended-partition disk image or removable medium to be probed can wrap cur_start + start to sector zero and cause libblkid to report a false partition overlapping the MBR. This directly compromises the integrity of the reported partition metadata; disk modification or availability loss requires a separate downstream consumer to act on that metadata. This issue is fixed in 2.41.4.

References

Affected packages

Azure Linux:3 / util-linux

Package

Name
util-linux
Purl
pkg:rpm/azure-linux/util-linux

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Last Affected
2.40.2-6

Database specific

source
"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-108198.json"