CVE-2025-8067: Linux Privilege Escalation Flaw Found in UDisks Daemon, PoC Releases

CVE-2025-8067 is a Linux privilege escalation flaw in the UDisks daemon, disclosed after a security researcher published a PoC that demonstrates how the issue can be exploited. The vulnerability arises in how the UDisks daemon handles loop device creation requests via the D-Bus system bus and allows an unprivileged user to use a negative fd_index value, leading to an out-of-bounds read in the GLib function g_unix_fd_list_get and the potential mapping of a daemon’s internal file descriptor to a loop device.

Successful exploitation can cause a denial of service by crashing the daemon, and more critically may enable local privilege escalation by exposing privileged files as loop devices. The flaw has a CVSS score of 8.5 and was reported to the Red Hat Product Security team, with patches released in updated UDisks versions 2.10.91 and 2.10.2. Users are urged to update to these fixed versions to prevent exploitation.