Package "libblkid1"

util-linux (2.39.3-9ubuntu6.6) noble-security; urgency=medium

  * SECURITY UPDATE: Heap use-after-free via crafted block device image
    - debian/patches/CVE-2026-13595.patch: libblkid: fix use-after-free in
      nested partition probing in libblkid/src/partitions/partitions.c.
    - CVE-2026-13595
  * SECURITY UPDATE: TOCTOU in mount utility
    - debian/patches/CVE-2026-27456.patch: loopdev: add LOOPDEV_FL_NOFOLLOW to
      prevent symlink attacks in include/loopdev.h, lib/loopdev.c,
      libmount/src/hook_loopdev.c.
    - CVE-2026-27456
  * SECURITY UPDATE: Local Privilege Escalation via TOCTOU in mount
    - debian/patches/CVE-2026-53612.patch: libmount: use fd-based fchownat/chmod
      in hook_owner in libmount/src/hook_owner.c.
    - CVE-2026-53612
  * SECURITY UPDATE: Another local Privilege Escalation via TOCTOU in mount
    - debian/patches/CVE-2026-53613-pre1.patch: lib/fileutils: add
      ul_open_no_symlinks() in configure.ac, include/fileutils.h,
      lib/fileutils.c, meson.build.
    - debian/patches/CVE-2026-53613.patch: libmount: add fd_target to context
      for TOCTOU prevention in libmount/src/context.c,
      libmount/src/context_mount.c, libmount/src/hook_mount.c,
      libmount/src/hook_mount_legacy.c, libmount/src/mountP.h.
    - CVE-2026-53613
  * SECURITY UPDATE: Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2
    Environment Variable
    - debian/patches/CVE-2026-53614.patch: libmount: fix SUID bypass via
      LIBMOUNT_FORCE_MOUNT2 and legacy mount path in libmount/src/hook_mount.c,
      libmount/src/hook_mount_legacy.c.
    - CVE-2026-53614
  * SECURITY UPDATE: Integer Overflow or Wraparound in dos.c
    - debian/patches/CVE-2026-53615.patch: libblkid: dos: validate EBR data and
      links within extended partition in libblkid/src/partitions/dos.c.
    - CVE-2026-53615

 -- Marc Deslauriers Wed, 19 Aug 2026 12:47:51 -0400

  util-linux (2.39.3-9ubuntu6.5) noble-security; urgency=medium

  * d/p/ubuntu/su-pty-drop-caps.patch: harden 'su --pty' to temporarily lower
    capabilities while proxying between stdin/stdout and the pty master. This
    is to avoid su from being used to exploit kernel vulnerabilities.

 -- Luci Stanescu <email address hidden> Fri, 06 Mar 2026 18:00:54 +0200

  util-linux (2.39.3-9ubuntu6.4) noble; urgency=medium

  * Add ARM core support for Vera systems (LP: #2123886)
    - d/p/ubuntu/lp-2123886-add-missing-arm-cores.patch

 -- Joao Andre Simioni <email address hidden> Mon, 15 Sep 2025 21:08:02 -0300

  util-linux (2.39.3-9ubuntu6.3) noble; urgency=medium

  * debian/patches/ubuntu/lp-2111723-0001-lscpu-New-Arm-Cortex-part-
    numbers.patch: [PATCH 1/4] lscpu: New Arm Cortex part numbers.
    Thanks to Jeremy Linton <email address hidden>. Closes LP:
    #2111723.
  * debian/patches/ubuntu/lp-2111723-0002-lscpu-use-CPU-types-de-
    duplication.patch: [PATCH 2/4] lscpu: use CPU types de-duplication.
    Thanks to Karel Zak <email address hidden>. Closes LP: #2111723.
  * debian/patches/ubuntu/lp-2111723-0003-tests-update-lscpu-vmware_fpe-
    output.patch: [PATCH 3/4] tests: update lscpu vmware_fpe output.
    Thanks to Karel Zak <email address hidden>. Closes LP: #2111723.
  * debian/patches/ubuntu/lp-2111723-0004-tests-add-dump-from-ARM-with-
    A510-A710-A715-X3.patch: [PATCH 4/4] tests: add dump from ARM with
    A510+A710+A715+X3. Thanks to Karel Zak <email address hidden>. Closes
    LP: #2111723.

 -- Andreas Glinserer <email address hidden> Thu, 05 Jun 2025 14:17:38 +0200

  util-linux (2.39.3-9ubuntu6.2) noble; urgency=medium

  * Read the ext4 superblock with O_DIRECT if the first read produces a
    checksum failure. This fixes a race where the underlying superblock
    can be changed in memory but not on disk, resulting in checksum
    failures which in turn causes systemd-udevd to remove by-uuid and
    by-label symlinks. (LP: #2090972)
    - d/p/ubuntu/lp2090972-libblkid-fix-spurious-ext-superblock-checksum-mismat.patch

 -- Matthew Ruffell <email address hidden> Thu, 05 Dec 2024 15:26:54 +1300