A flaw in udisks2's handling of the 'as-user' option in the org.freedesktop.UDisks2.Filesystem.Mount() D-Bus method allows a local attacker with an active console session to spoof the 'as-user' parameter. This enables mounting filesystems on behalf of arbitrary users, including privileged accounts, which can result in local privilege escalation through mount point injection and manipulation of the mount namespace visible to privileged users. The vulnerability is tracked as CVE-2026-7867 and affects Red Hat Enterprise Linux 10. The CVSS v3.1 score is 7.8, indicating high severity with impacts on confidentiality, integrity, and availability. The vendor advisory confirms the issue but does not specify a remediation level or patch availability at this time.

The vulnerability allows a local attacker with low privileges and an active console session to escalate privileges by mounting filesystems as other users, including privileged accounts. This can lead to unauthorized access to sensitive data, modification of system files, execution of unauthorized commands, and potential denial of service through resource exhaustion or system instability. The CVSS score of 7.8 reflects high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-7867 for current remediation guidance. No official fix or temporary workaround is currently documented in the advisory. Users should monitor the vendor advisory for updates and apply patches once available. Until then, restricting local console access to trusted users may reduce risk.