A flaw was found in libblockdev. (CVE-2026-111581)

The libblockdev library contains a flaw in its bd_fs_ntfs_set_label() and bd_fs_vfat_set_label() functions, which pass user-supplied label values directly as positional arguments to the ntfslabel and fatlabel utilities without using end-of-options separators or validating inputs that begin with a dash ('-'). This can cause the label to be interpreted as a command-line flag by these utilities, potentially bypassing safety checks or triggering unintended operations. The vulnerability is exploitable by unprivileged local users via the udisks2 Filesystem.SetLabel() D-Bus method without requiring administrator privileges. The CVSS v3.1 base score is 3.3, reflecting low severity with limited impact on integrity and no impact on confidentiality or availability.

Unprivileged local users can exploit this flaw to cause the ntfslabel and fatlabel utilities to misinterpret label inputs as command-line options, potentially bypassing safety checks or causing unintended operations. The impact is limited to integrity with no confidentiality or availability impact. There are no known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid setting filesystem labels with values beginning with a dash ('-') through the affected interfaces. Monitor vendor communications for official fixes or workarounds.