CVE-2026-13595 is a heap use-after-free vulnerability in the libblkid library of util-linux on Red Hat Enterprise Linux 10. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers store a raw pointer to a parent partition entry in a dynamically allocated array. When the array is reallocated due to subsequent partition additions, the cached pointer becomes stale, causing a use-after-free read. Because libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events, an attacker can trigger this vulnerability by presenting a crafted block device image (e.g., via USB insertion or loop-mounted disk image) without requiring user interaction. The vulnerability can lead to limited information disclosure or denial of service.

An attacker capable of presenting a crafted block device image can trigger a heap use-after-free read in libblkid, potentially causing limited information disclosure or denial of service on affected Red Hat Enterprise Linux 10 systems. The vulnerability is exploitable without user interaction and runs with root privileges due to automatic invocation by udev/udisks on block-device hot-plug events.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-13595 for current remediation guidance. Until an official fix is available, consider restricting untrusted block device insertions or disabling automatic probing of block devices if feasible. Monitor the vendor advisory for updates on patches or workarounds.