CVE-2026-76642

util-linux versions through 2.41.5 and through 2.42.2 fail to check the exit status of mount helpers before running post-mount hooks, so privileged post-mount actions still execute after a helper has failed. A local unprivileged user who can trigger affected mount paths (for example fstab-based mounts using the X-mount.idmap or X-mount.owner hooks) can induce a helper failure and have the hooks clone filesystems with inherited suid bits or modify target inode permissions. Successful exploitation yields local privilege escalation, letting the attacker perform privileged operations on pre-existing filesystems. Any Linux deployment running an affected util-linux version is potentially affected, though exploitability depends on local configurations that allow unprivileged users to invoke these mount helpers rather than on network exposure. No public proof-of-concept is known, the flaw is not in CISA KEV, and EPSS assigns only a 0.2% probability of exploitation in the next 30 days.

What to do: Upgrade to util-linux 2.42.3, or to your distribution's patched package as soon as it is available. Until patched, audit fstab and automount configurations that permit unprivileged users to invoke mount helpers with X-mount.idmap or X-mount.owner and restrict or remove such entries. Also check local mounts for unexpectedly retained suid bits or changed ownership/permissions on target inodes, which would indicate attempted exploitation.