CVE-2026-13595 is a heap use-after-free vulnerability in the libblkid library of util-linux, specifically in the nested partition probing code. The BSD, Minix, Solaris x86, and UnixWare partition probers cache raw pointers to parent partition entries in a dynamically allocated array. When the array is reallocated due to additional partitions, these pointers become stale, leading to use-after-free reads. This flaw can be triggered automatically by libblkid, which runs as root during block device hot-plug events via udev/udisks, when a crafted block device image is introduced. The vulnerability allows an attacker with local access to cause denial of service or limited information disclosure. Red Hat has released an advisory describing the issue and the updated RPM packages included in the Red Hat Hardened Images update. However, no official patch or fix meeting Red Hat's criteria is currently available. Mitigation options are either unavailable or impractical. The vulnerability is rated as medium severity by Red Hat.

An attacker with local access who can introduce crafted block device images (e.g., via USB or loop-mounted images) can trigger a heap use-after-free in libblkid, potentially causing denial of service (system crash) or limited disclosure of information. The vulnerability is automatically triggered by libblkid running as root during device hot-plug events, increasing exposure. There is no indication of remote exploitation or privilege escalation beyond local access. No known exploits are reported in the wild.

Currently, no effective mitigation is available that meets Red Hat's criteria for ease of use, deployment, and stability. Users should apply the updated Red Hat Hardened Images RPM packages when they become available. Until a fix is released, avoid introducing untrusted block devices to vulnerable systems. Monitor Red Hat advisories for updates and patches. Customers with a Red Hat Technical Account Manager (TAM) can seek direct guidance.