CVE-2025-6019 is a local privilege escalation vulnerability in libblockdev, a C library used for low-level block device operations. The vulnerability involves the interaction between libblockdev and the udisks daemon under Polkit's "allow_active" setting, which permits certain actions by physically present users based on session type. Normally, udisks mounts user-provided filesystem images with security flags (nosuid, nodev) to prevent privilege escalation. However, an attacker can craft a malicious XFS image containing a SUID-root shell and induce udisks to resize it, resulting in the malicious filesystem being mounted with root privileges. This allows execution of the SUID-root shell and full root access on the host. Red Hat has issued security advisories and updates for Red Hat Enterprise Linux 7 Extended Life Cycle Support and 8.2 Advanced Update Support to fix this issue.

A local attacker with physical presence and an "allow_active" Polkit session can escalate privileges to root by exploiting the way libblockdev and udisks handle specially crafted XFS filesystem images. Successful exploitation results in full system compromise with root-level control. The CVSS v3.1 base score is 7.0 (High), reflecting high confidentiality, integrity, and availability impacts.

Red Hat has released official security updates for libblockdev that address this vulnerability. Users should apply the relevant patches as described in the Red Hat advisories RHSA-2025:10796 for RHEL 7 Extended Life Cycle Support and RHSA-2025:9320 for RHEL 8.2 Advanced Update Support. Before applying these updates, ensure all previously released errata are applied. No additional mitigations are indicated by the vendor advisory.