Answer in brief
CVE-2025-8067 records a High severity (CVSS 8.5) vulnerability in Udisks: out-of-bounds read in udisks daemon. The current sources do not mark it as known exploited. The current feed maps storaged-project/udisks (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
Answer in brief
CVE-2025-8067 records a High severity (CVSS 8.5) vulnerability in Udisks: out-of-bounds read in udisks daemon. The current sources do not mark it as known exploited. The current feed maps storaged-project/udisks (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 8.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps storaged-project/udisks (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| storaged-project/udisksgeneric | >=0 <2.10.2 || >=2.10.3 <2.10.91 | 2.10.2, 2.10.91 |
Published upstream
Aug 28, 2025
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Jun 29, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jun 25, 2026
A flaw was found in the Udisks daemon, where it allows unprivileged users to create loop devices using the D-BUS system. This is achieved via the loop device handler, which handles requests sent through the D-BUS interface. As two of the parameters of this handle, it receives the file descriptor list and index specifying the file where the loop device should be backed. The function itself validates the index value to ensure it isn't bigger than the maximum value allowed. However, it fails to validate the lower bound, allowing the index parameter to be a negative value. Under these circumstances, an attacker can cause the UDisks daemon to crash or perform a local privilege escalation by gaining access to files owned by privileged users.
Quoted source text, attributed separately from HOL analysis.
CVSS is 8.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps storaged-project/udisks (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| storaged-project/udisksgeneric | >=0 <2.10.2 || >=2.10.3 <2.10.91 | 2.10.2, 2.10.91 |
Published upstream
Aug 28, 2025
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Jun 29, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jun 25, 2026
A flaw was found in the Udisks daemon, where it allows unprivileged users to create loop devices using the D-BUS system. This is achieved via the loop device handler, which handles requests sent through the D-BUS interface. As two of the parameters of this handle, it receives the file descriptor list and index specifying the file where the loop device should be backed. The function itself validates the index value to ensure it isn't bigger than the maximum value allowed. However, it fails to validate the lower bound, allowing the index parameter to be a negative value. Under these circumstances, an attacker can cause the UDisks daemon to crash or perform a local privilege escalation by gaining access to files owned by privileged users.
Quoted source text, attributed separately from HOL analysis.