Two new vulnerabilities allow hackers to easily obtain root permissions, and almost all Linux distributions are hit

Passionategeekz On June 18, security researchers discovered two new local permission escalation vulnerabilities (LPE).Attackers can exploit these vulnerabilities to fully control the system or gain root permissionsaffecting major Linux distributions. This discovery has aroused the vigilance of system administrators around the world.

• The first vulnerability, number CVE-2025-6018, exists in the Pluggable Authentication Module (PAM) configuration of openSUSE Leap 15 and SUSE Linux Enterprise 15 systems. The vulnerability allows local attackers to obtain “allow_active” user permissions.

• The second vulnerability, number CVE-2025-6019, exists in the libblockdev library. The vulnerability allows users who have obtained “allow_active” permission to escalate permission to root through the udisks daemon, a storage management service that runs by default in most Linux distributions.

The Qualys Threat Research Group (TRU), which discovered and reported these two vulnerabilities yesterday, developed a proof of concept.And successfully used CVE-2025-6019 to obtain root permissions in Ubuntu, Debian, Fedora and openSUSE Leap 15 systems。

Saeed Abbasi, senior manager of Qualys TRU, warned: “While the nominal ‘allow_active’ permission is required, udisks exists by default in almost all Linux distributions, so nearly all systems are vulnerable. Attackers can stitch these vulnerabilities to achieve direct root access with minimal effort.”

Passionategeekz noted that given the ubiquitous presence of udisks and the simplicity of exploitation, the group’s recommendation is very clear: This should be viewed as a critical and universal risk, and apply security patches immediately.

Advertising statement: The external redirect links (including, not limited to, hyperlinks, QR codes, passwords, etc.) contained in the article are used to convey more information and save selection time. The results are for reference only. All articles from Passionategeekz include this statement.