A flaw in udisks2's handling of the 'as-user' parameter in the D-Bus Mount() method allows a local attacker with an active console session to spoof this parameter and mount filesystems as arbitrary users, including privileged accounts. This incorrect authorization can lead to local privilege escalation via mount point injection and manipulation of the mount namespace. The vulnerability has a CVSS v3.1 score of 7.8 (high severity) and affects Red Hat Enterprise Linux 10. Red Hat has released a security update (udisks2-2.11.0-2.el10_2.1) that fixes this issue.

The vulnerability allows a local attacker with low privileges and an active console session to escalate privileges to those of arbitrary users, including privileged accounts, by exploiting insufficient authorization checks in udisks2. This can compromise confidentiality, integrity, and availability by enabling unauthorized mounting of filesystems, manipulation of mount namespaces, and execution of unauthorized commands. The CVSS score of 7.8 reflects high impact on confidentiality, integrity, and availability.

Red Hat has released an official security update for udisks2 in Red Hat Enterprise Linux 10 to address this vulnerability. Users should apply the update udisks2-2.11.0-2.el10_2.1 or later as provided in Red Hat Security Advisory RHSA-2026:53435. No additional mitigations are specified by the vendor. Patch status is confirmed as fixed in this update.