CVE-2026-13595: MLflow — MEDIUM

A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be...

Full CISO analysis pending enrichment.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
MLflow	pip	—	No patch
28.6KOpenSSF 5.4695 dependentsPushed 5d ago20% patched~68d to patchFull package profile →
MLflow	pip	—	No patch
28.6KOpenSSF 5.4695 dependentsPushed 5d ago20% patched~68d to patchFull package profile →
MLflow	pip	—	No patch
28.6KOpenSSF 5.4695 dependentsPushed 5d ago20% patched~68d to patchFull package profile →
costmanagement/costmanagement-ui-rhel10	—	—	No patch
openshift/ose-rhel-coreos-8	—	—	No patch
openshift/ose-rhel-coreos-9	—	—	No patch
rhoai/odh-ai-gateway-operator-rhel9	—	—	No patch
rhoai/odh-core-bff-rhel9	—	—	No patch
rhoai/odh-dashboard-operator-rhel9	—	—	No patch
rhoai/odh-dashboard-rhel9	—	—	No patch
rhoai/odh-data-science-pipelines-operator-controller-rhel9	—	—	No patch
rhoai/odh-kf-notebook-controller-rhel9	—	—	No patch
rhoai/odh-kserve-controller-rhel9	—	—	No patch
rhoai/odh-kserve-llmisvc-controller-rhel9	—	—	No patch
rhoai/odh-kserve-module-operator-rhel9	—	—	No patch
rhoai/odh-kube-rbac-proxy-rhel9	—	—	No patch
rhoai/odh-kuberay-operator-controller-rhel9	—	—	No patch
rhoai/odh-llama-stack-k8s-operator-rhel9	—	—	No patch
rhoai/odh-maas-controller-rhel9	—	—	No patch
rhoai/odh-mod-arch-agent-ops-rhel9	—	—	No patch
rhoai/odh-mod-arch-automl-rhel9	—	—	No patch
rhoai/odh-mod-arch-autorag-rhel9	—	—	No patch
rhoai/odh-mod-arch-eval-hub-rhel9	—	—	No patch
rhoai/odh-mod-arch-gen-ai-rhel9	—	—	No patch
rhoai/odh-mod-arch-maas-rhel9	—	—	No patch
rhoai/odh-mod-arch-model-registry-rhel9	—	—	No patch
rhoai/odh-model-controller-rhel9	—	—	No patch
rhoai/odh-model-registry-operator-rhel9	—	—	No patch
rhoai/odh-model-serving-api-rhel9	—	—	No patch
rhoai/odh-notebook-controller-rhel9	—	—	No patch
rhoai/odh-ogx-k8s-operator-rhel9	—	—	No patch
rhoai/odh-ogx-module-operator-rhel9	—	—	No patch
rhoai/odh-training-operator-rhel9	—	—	No patch
rhoai/odh-trustyai-service-operator-rhel9	—	—	No patch
rhoai/odh-workbenches-operator-rhel9	—	—	No patch
util-linux	—	—	No patch
util-linux-main	—	—	No patch

How severe is it?

CVSS 3.1

6.8 / 10

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

N/A

What is the attack surface?

AVLocal

ACLow

PRNone

UINone

SUnchanged

CLow

INone

AHigh

What should I do?

No patch available

Monitor for updates. Consider compensating controls or temporary mitigations.

Which compliance frameworks are affected?

Compliance analysis pending. Sign in for full compliance mapping when available.

Frequently Asked Questions

What is CVE-2026-13595?

A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.

Is CVE-2026-13595 actively exploited?

No confirmed active exploitation of CVE-2026-13595 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-13595?

No patch is currently available. Monitor vendor advisories for updates.

What is the CVSS score for CVE-2026-13595?

CVE-2026-13595 has a CVSS v3.1 base score of 6.8 (MEDIUM).

What are the technical details?

Original Advisory

A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.

Weaknesses (CWE)

CWE-416Use After Free

CWE-416 — Use After Free: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

[Architecture and Design] Choose a language that provides automatic memory management.
[Implementation] When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.

Source: MITRE CWE corpus.