A critical vulnerability, CVE-2025-8067, has been identified in the Linux UDisks daemon, impacting multiple versions of Red Hat Enterprise Linux (RHEL 6–10). The flaw, publicly disclosed on August 28, 2025, carries a CVSS v3 score of high and has been rated Important due to its privilege escalation potential. A security researcher discovered the issue, which could allow unprivileged attackers with local access to bypass permission controls and gain unauthorized access to sensitive files owned by privileged users.

The vulnerability stems from improper input validation in the UDisks daemon’s loop device handler, specifically when processing requests through the D-BUS interface. While the daemon validates the upper bound of the index parameter used to specify a backing file for loop device creation, it fails to check the lower bound. This oversight enables attackers to submit negative index values, resulting in an out-of-bounds read condition (CWE-125). Exploitation could lead to daemon crashes, disclosure of sensitive memory contents such as cryptographic keys and memory addresses, or full local privilege escalation.

Researcher confirmed that the flaw affects RHEL 10, 9, 8, 7, and the out-of-support RHEL 6 versions. The attack requires local system access and the ability to send D-BUS requests, but it does not require prior privileges or user interaction, making exploitation relatively simple. The CVSS vector (AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H) highlights a local attack vector with low complexity and significant impact, including low confidentiality and integrity impact but high availability impact. Additionally, the memory disclosure risk could undermine security protections such as Address Space Layout Randomization (ASLR), further increasing exploitation potential.

Currently, there are no workarounds or mitigations, and Researcher has urged organizations to apply security patches as soon as they are released. Given the ease of exploitation and the potential for sensitive data exposure and system compromise, affected organizations should prioritize patching and closely monitor for signs of exploitation attempts. Failure to address this flaw promptly could allow attackers to escalate privileges and compromise critical Linux environments.