CVE-2025-6019: udisks2 TOCTOU Race Condition → Local Privilege Escalation | Polkit Bypass & SUID Exploit
udisks2 handles XFS resize via temporary /tmp/blockdev.XXXXXX mount points. Between mount creation and nosuid application, a race window allows SUID binary execution. Three-stage exploit: Polkit bypass via ~/.pam_environment local seat0 session spoofing, XFS image crafting with pwnbash SUID binary baked into mkfs.xfs Protofile metadata, D-Bus resize request flood to continuously recreate race window. Architecture-agnostic (x86/x64/ARM). Confirmed LPE on openSUSE Leap 15.6 kernel 6.4.0.
