CVE-2026-7867
The following vulnerability has been discovered in the UDisks storage daemon: CVE-2026-7867 Azizcan Dastan and Ozlem Ozan discovered a local privilege escalation vulnerability in udisks2 involving the Filesystem.Mount D-Bus method. Using the 'as-user' option, an unprivileged local user can in some cases influence the mount execution path so that a filesystem mount is performed in a privileged/root context without the expected PolicyKit authorization behavior. https://security-tracker.debian.org/tracker/DSA-6414-1
CSIRTS triage
- What
- Local privilege escalation in UDisks2 Filesystem.Mount D-Bus method via 'as-user' option allows unprivileged user to bypass PolicyKit authorization.
- Who is affected
- Systems running vulnerable UDisks2 with unprivileged local users.
- Urgency
- High urgency for systems with untrusted local users; privilege escalation is directly exploitable.
- Action
- Apply Debian DSA-6414-1 security update to UDisks2.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch CVE-2026-7867
Get an email if CVE-2026-7867 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Advisory coverage (2)
- highCVE-2026-7867: A flaw was found in udisks2. A local attacker with an active console session can exploit insuff…nvd · 2026-08-06
- unknownDSA-6414-1 udisks2 - security updatedebian · 2026-08-06
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-7867)