CVE-2025-6019 Vulnerability

Attackers can now exploit two newly discovered local privilege escalation (LPE) vulnerabilities to gain full root access on systems running popular Linux distributions. These flaws, if left unpatched, pose a severe risk to enterprise environments.

CVE-2025-6018: PAM Misconfiguration Opens the Door

The first vulnerability, tracked as CVE-2025-6018, resides in the configuration of the Pluggable Authentication Modules (PAM) framework. It affects openSUSE Leap 15 and SUSE Linux Enterprise 15. This flaw allows local attackers to escalate their privileges to that of the special 'allow_active' user—an essential stepping stone for a root compromise.

CVE-2025-6019: libblockdev + Udisks Equals Full Root

The second flaw, CVE-2025-6019, lies in libblockdev and impacts the udisks daemon, a storage management service that runs by default on most Linux systems. This vulnerability allows an 'allow_active' user to elevate privileges directly to root. Because udisks is widely deployed and active by default, nearly any Linux system is at risk.

Exploitation Chain: From Local Access to Root in Seconds

Attackers can combine these two vulnerabilities into a 'local-to-root' chain exploit. First, they abuse the PAM flaw to gain 'allow_active' status, then leverage the udisks flaw to obtain full root access. This combination significantly lowers the barrier to compromise, making it possible to take over SUSE systems almost instantly.

Cross-Distro Risk: Not Just a SUSE Problem

Although discovered in SUSE systems, the researchers demonstrated that CVE-2025-6019 also affects other major distributions, including Ubuntu, Debian, and Fedora. Using proof-of-concept (PoC) exploits, they successfully escalated to root privileges on these platforms, confirming the broad applicability of the attack.

Root Access: A Gateway to Deeper Threats

Gaining root privileges is a worst-case scenario: it allows for agent tampering, persistence mechanisms, and lateral movement across networks. One unpatched machine could jeopardize the security of an entire server fleet.

Act Fast: Universal Risk Demands Immediate Patching

Given the ubiquity of udisks and the ease with which the exploit chain works, organizations must treat this as a critical vulnerability. Immediate patching of both the PAM configuration and the libblockdev/udisks flaw is essential to eliminate this path to root compromise.

A Pattern of Persistent Linux Threats

These LPE flaws are part of a growing trend in Linux security threats. Other recent high-profile vulnerabilities include:

• PwnKit (Polkit's pkexec)
• Looney Tunables (glibc's ld.so)
• Sequoia (Kernel filesystem layer)
• Baron Samedit (Sudo privilege escalation)

In the case of Looney Tunables, PoC code was released shortly after disclosure. Within a month, real-world attacks emerged using Kinsing malware to steal cloud service provider (CSP) credentials.

Conclusion: Secure Your Linux Infrastructure Now

The discovery of CVE-2025-6018 and CVE-2025-6019 reinforces the urgent need for continuous patch management and proactive monitoring. These vulnerabilities represent a critical, cross-distribution risk, and must be addressed immediately to prevent compromise at the root level.