UbuntuUpdates.org

Package "udisks2"

Name: udisks2

Description:

D-Bus service to access and manipulate storage devices
Latest version: 2.10.91-1ubuntu2.1
Release: resolute (26.04)
Level: security
Repository: main
Homepage: https://www.freedesktop.org/wiki/Software/udisks

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "udisks2"

32-bit deb package
64-bit deb package
APT INSTALL

Other versions of "udisks2" in Resolute

Repository Area Version
base main 2.10.91-1ubuntu2
base universe 2.10.91-1ubuntu2
security universe 2.10.91-1ubuntu2.1
updates universe 2.10.91-1ubuntu2.1
updates main 2.10.91-1ubuntu2.1

Packages in group

Deleted packages are displayed in grey.


Changelog

Version: 2.10.91-1ubuntu2.1 2026-08-31 14:07:55 UTC

udisks2 (2.10.91-1ubuntu2.1) resolute-security; urgency=medium

  * SECURITY UPDATE: Privilege escalation via mount point injection
    - debian/patches/CVE-2026-7867-1.patch: udiskslinuxfilesystem: Separate real
      caller identity from as-user target in src/udiskslinuxfilesystem.c.
    - debian/patches/CVE-2026-7867-2.patch: udiskslinuxfilesystem: Rework fstab
      mount authorization for as-user in data/org.freedesktop.UDisks2.xml,
      src/udiskslinuxfilesystem.c.
    - debian/patches/CVE-2026-7867-3.patch: udiskslinuxfilesystem: Log real
      caller uid for as-user mounts in src/udiskslinuxfilesystem.c.
    - debian/patches/CVE-2026-7867-4.patch: udisksdaemonutil: Pass as-user
      target to polkit details in src/udisksdaemonutil.c.
    - debian/patches/CVE-2026-7867-5.patch: tests: Add security tests for as-
      user mount authorization in src/tests/dbus-tests/test_80_filesystem.py.
    - CVE-2026-7867

 -- Marc Deslauriers Mon, 17 Aug 2026 10:41:39 -0400
CVE-2026-7867 A flaw was found in udisks2. A local attacker with an active console session can exploit insufficient authorization checking on the 'as-user' option


About   -   Send Feedback to @ubuntu_updates