CVE-2025-6019: Libblockdev: lpe from allow_active to root in libblockdev via udisks

Security readout for executives and security teams

CVE-2025-6019 is a local privilege escalation flaw in libblockdev when used through udisks. A user who already has local access and an active session may be able to move from limited privileges to full root control. This is not a remote internet bug, but it matters on shared Linux systems, workstations, and servers with untrusted local users. Structured affected data names Red Hat Enterprise Linux 7 ELS, 8, 9, 10, and several AUS/EUS/E4S/TUS/SAP channels with affected libblockdev builds. Other referenced distribution advisories should be checked directly. Exposure requires local access and relevant udisks/libblockdev functionality, so prioritize multi-user Linux hosts and managed workstations. Patch on a high-priority operational cycle, especially for shared Linux servers, jump hosts, developer workstations, and environments where low-privilege local access is plausible. The main business risk is that a minor local foothold could become full host compromise. Mitigation focus: Apply vendor-provided libblockdev and udisks updates for affected distributions.; Review Red Hat errata matching each RHEL channel in use.; Check Debian, SUSE, and other distro advisories for package-specific status..

Prepared

Jun 30, 2026, 14:17 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.