Skip to content
Fencer Intel
medium 6.1

CVE-2025-14104 json

Util-linux: util-linux: heap buffer overread in setpwnam() when processing 256-byte usernames

published 11mo ago modified 6d ago also EUVD-2025-201450

cvss
6.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 11%
public exploits
0
none known

Summary

A flaw was found in util-linux. This vulnerability allows a heap buffer overread when processing 256-byte usernames, specifically within the `setpwnam()` function, affecting SUID (Set User ID) login-utils utilities writing to the password database.

Patch / fix

  • util-linux util-linux 2.41.3
  • Red Hat Red Hat Enterprise Linux 10 0:2.40.2-15.el10_1
  • Red Hat Red Hat Enterprise Linux 8 0:2.32.1-48.el8_10
  • Red Hat Red Hat Enterprise Linux 9 0:2.37.4-21.el9_7
  • Red Hat Cert Manager support for Red Hat OpenShift release 1.18 1789029076, 1791459707, 1791459711, 1791459759, 1791966259
  • Red Hat Red Hat Ceph Storage 7 1770632724
  • Red Hat Red Hat Ceph Storage 8 1770630907
  • Red Hat Red Hat Ceph Storage 9 1771816028
  • Red Hat Red Hat Hardened Images 2.42-7.1.hum1
  • Red Hat Red Hat Insights proxy 1.5 1770740405
  • Red Hat Red Hat Update Infrastructure 5 1770646925, 1773670073, 1773670137, 1773672059
  • util-linux Debian 14, Debian 13 2.41.3-1

debian advisories DEBIAN-CVE-2025-14104

  • util-linux hummingbird 1 2.42-7.1.hum1
  • util-linux-core hummingbird 1 2.42-7.1.hum1
  • util-linux-i18n hummingbird 1 2.42-7.1.hum1
  • util-linux-script hummingbird 1 2.42-7.1.hum1
  • util-linux RHEL 9 2.37.4-21.el9_7
  • uuidd RHEL 9 2.37.4-21.el9_7
  • libuuid RHEL 9 2.37.4-21.el9_7
  • libblkid RHEL 9 2.37.4-21.el9_7

red hat advisories RHSA-2026:7180RHSA-2026:1913RHSA-2026:1852RHSA-2026:1696

  • util-linux SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 2.41.1-160000.3.1
  • util-linux-systemd SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 2.41.1-160000.3.1
  • python-libmount SLES for SAP applications 16.0, SLES 16.0 2.41.1-160000.3.1
  • util-linux SLE Micro 5.4, SLE Micro 5.3 2.37.2-150400.8.38.1
  • util-linux-systemd SLE Micro 5.4, SLE Micro 5.3 2.37.2-150400.8.38.1
  • util-linux Linux Micro 6.0 2.39.3-4.1
  • util-linux-systemd Linux Micro 6.0 2.39.3-4.1
  • util-linux SLE Module for Basesystem 15 SP7 2.40.4-150700.4.3.1

suse advisories SUSE-SU-2026:21016-1SUSE-SU-2026:21158-1SUSE-SU-2026:0510-1SUSE-SU-2026:20346-1SUSE-SU-2026:0366-1SUSE-SU-2026:0230-1

  • util-linux openSUSE Leap 16.0 2.41.1-160000.3.1
  • python-libmount openSUSE Leap 16.0 2.41.1-160000.3.1
  • util-linux-systemd openSUSE Leap 16.0 2.41.1-160000.3.1
  • util-linux openSUSE Tumbleweed 2.41.3-1.1

opensuse advisories openSUSE-SU-2026:20495-1openSUSE-SU-2026:10072-1

  • util-linux AlmaLinux 9 2.37.4-21.el9_7
  • uuidd AlmaLinux 9 2.37.4-21.el9_7
  • libuuid AlmaLinux 9 2.37.4-21.el9_7
  • libblkid AlmaLinux 9 2.37.4-21.el9_7
  • libfdisk AlmaLinux 9 2.37.4-21.el9_7
  • libmount AlmaLinux 9 2.37.4-21.el9_7
  • libsmartcols AlmaLinux 9 2.37.4-21.el9_7
  • util-linux-core AlmaLinux 9 2.37.4-21.el9_7

almalinux advisories ALSA-2026:1913ALSA-2026:1852ALSA-2026:1696

  • util-linux Rocky Linux 8 2.32.1-48.el8_10
  • util-linux Rocky Linux 10 2.40.2-15.el10_1
  • util-linux Rocky Linux 9 2.37.4-21.el9

rocky linux advisories RLSA-2026:1852RLSA-2026:1696RLSA-2026:1913

  • util-linux Alpine 3.22 2.41.6-r0
  • util-linux Alpine 3.23 2.41.4-r0

alpine advisories ALPINE-CVE-2025-14104

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • util-linux Azure Linux 3.0 2.40.2-3
  • util-linux CBL-Mariner 2.0 2.37.4-10

azure linux advisories AZL-72305AZL-72307

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Is CVE-2025-14104 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-14104 updated cvss 6.1

util-linux: util-linux: Heap buffer overread in setpwnam() when processing 256-byte usernames

  • Red Hat Enterprise Linux 6 uuidd, libuuid, libblkid, util-linux-ng Red Hat Enterprise Linux 7 uuidd, libuuid, libblkid, libmount, util-linux Red Hat OpenShift Container Platform 4 openshift/ose-rhel-coreos-8, openshift/ose-rhel-coreos-9
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Cert Manager support for Red Hat OpenShift release 1.18 cert-manager/cert-manager-operator-rhel9 1789029076, cert-manager/jetstack-cert-manager-rhel9 1791459711, cert-manager/cert-manager-istio-csr-rhel9 1791459759, cert-manager/cert-manager-operator-bundle 1791966259, cert-manager/jetstack-cert-manager-acmesolver-rhel9 1791459707
    fixed: vendor fix RHSA-2026:82354
  • Red Hat Ceph Storage 7 rhceph 1770632724
    fixed: vendor fix RHSA-2026:2800
  • Red Hat Ceph Storage 8 rhceph 1770630907
    fixed: vendor fix RHSA-2026:2737
  • Red Hat Ceph Storage 9 rhceph 1771816028
    fixed: vendor fix RHSA-2026:3406
  • Red Hat Enterprise Linux AppStream (v. 8) python3-libmount 2.32.1-48.el8_10
    fixed: vendor fix RHSA-2026:1852
  • Red Hat Enterprise Linux AppStream (v. 9) uuidd 2.37.4-21.el9_7, python3-libmount 2.37.4-21.el9_7
    fixed: vendor fix RHSA-2026:1913
  • Red Hat Enterprise Linux AppStream (v. 10) uuidd 2.40.2-15.el10_1, python3-libmount 2.40.2-15.el10_1
    fixed: vendor fix RHSA-2026:1696
show 10 more
  • Red Hat Enterprise Linux BaseOS (v. 8) uuidd 2.32.1-48.el8_10, libuuid 2.32.1-48.el8_10, libblkid 2.32.1-48.el8_10, libfdisk 2.32.1-48.el8_10, libmount 2.32.1-48.el8_10, util-linux 2.32.1-48.el8_10, +2 more
    fixed: vendor fix RHSA-2026:1852
  • Red Hat Enterprise Linux BaseOS (v. 9) libuuid 2.37.4-21.el9_7, libblkid 2.37.4-21.el9_7, libfdisk 2.37.4-21.el9_7, libmount 2.37.4-21.el9_7, util-linux 2.37.4-21.el9_7, libsmartcols 2.37.4-21.el9_7, +2 more
    fixed: vendor fix RHSA-2026:1913
  • Red Hat Enterprise Linux BaseOS (v. 10) libuuid 2.40.2-15.el10_1, libblkid 2.40.2-15.el10_1, libfdisk 2.40.2-15.el10_1, libmount 2.40.2-15.el10_1, util-linux 2.40.2-15.el10_1, libsmartcols 2.40.2-15.el10_1, +1 more
    fixed: vendor fix RHSA-2026:1696
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) libfdisk-devel 2.37.4-21.el9_7, uuidd-debuginfo 2.37.4-21.el9_7, libuuid-debuginfo 2.37.4-21.el9_7, libblkid-debuginfo 2.37.4-21.el9_7, libfdisk-debuginfo 2.37.4-21.el9_7, libmount-debuginfo 2.37.4-21.el9_7, +7 more
    fixed: vendor fix RHSA-2026:1913
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) libfdisk-devel 2.40.2-15.el10_1, uuidd-debuginfo 2.40.2-15.el10_1, libuuid-debuginfo 2.40.2-15.el10_1, libblkid-debuginfo 2.40.2-15.el10_1, libfdisk-debuginfo 2.40.2-15.el10_1, libmount-debuginfo 2.40.2-15.el10_1, +6 more
    fixed: vendor fix RHSA-2026:1696
  • Red Hat Enterprise Linux CRB (v. 8) libmount-devel 2.32.1-48.el8_10, uuidd-debuginfo 2.32.1-48.el8_10, libuuid-debuginfo 2.32.1-48.el8_10, libblkid-debuginfo 2.32.1-48.el8_10, libfdisk-debuginfo 2.32.1-48.el8_10, libmount-debuginfo 2.32.1-48.el8_10, +5 more
    fixed: vendor fix RHSA-2026:1852
  • Red Hat Hardened Images util-linux 2.42-7.1.hum1, util-linux-core 2.42-7.1.hum1, util-linux-i18n 2.42-7.1.hum1, util-linux-script 2.42-7.1.hum1
    fixed: vendor fix RHSA-2026:7180
  • Red Hat Insights proxy 1.5 insights-proxy 1770740405
    fixed: vendor fix RHSA-2026:2485
  • Red Hat Update Infrastructure 5 rhui5 1770646925, rhui5 1773670073, rhui5 1773670137, rhui5 1773672059
    fixed: vendor fix RHSA-2026:4943
  • Red Hat Ceph Storage 7 rhceph 1770642181, rhceph 1770649294, rhceph 1770649398, rhceph 1770650099, rhceph 1770708805 Red Hat Ceph Storage 8 rhceph 1770630607, rhceph 1770631713, rhceph 1770631941, rhceph 1770632172, rhceph 1770632233 Red Hat Ceph Storage 9 rhceph 1771398877, rhceph 1771399022, rhceph 1771399060, rhceph 1771399158, rhceph 1771399331 Red Hat Hardened Images uuidd 2.42-7.1.hum1, libuuid 2.42-7.1.hum1, libblkid 2.42-7.1.hum1, libfdisk 2.42-7.1.hum1, libmount 2.42-7.1.hum1, liblastlog2 2.42-7.1.hum1, +2 more Red Hat Update Infrastructure 5 rhui5 1770807477, rhui5 1770808689, rhui5 1770808765, rhui5 1773668803
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
11mo ago

Exploit prediction

0.22% chance of exploitation in the next 30 days, higher than 11% of all scored CVEs (FIRST EPSS, 2026-11-11).

CVSS scores

assigned by version score vector
CNA 3.1 6.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H

Affected products

  • util-linux util-linux
  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Cert Manager support for Red Hat OpenShift release 1.18
  • Red Hat Red Hat Ceph Storage 7
  • Red Hat Red Hat Ceph Storage 8
  • Red Hat Red Hat Ceph Storage 9
  • Red Hat Red Hat Hardened Images
  • Red Hat Red Hat Insights proxy 1.5
  • Red Hat Red Hat Update Infrastructure 5
  • Red Hat Red Hat Enterprise Linux 6
  • Red Hat Red Hat Enterprise Linux 7
  • Red Hat Red Hat OpenShift Container Platform 4

Classification

Weakness

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.