Vulnerability fixes in util-linux-2.42.3
util-linux 2.42.3 patches mount(8) flaws CVE-2026-76642 and CVE-2026-78410, which allow privileged operations after mount helper failure.
30
Vulnerability3 · 1 read
CVE-2026-78410
TOCTOU race in util-linux mount(8) lets local users redirect restricted bind mounts
- CVSS 3.1
- 7.8 high
- EPSS
- <1%p1
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
A time-of-check to time-of-use (TOCTOU) race (CWE-367) exists in util-linux's mount(8): restricted bind mounts take their source path from fstab but do not pin that source before performing the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor directory can race the SUID mount helper, causing it to bind a different host directory than the one authorized in fstab. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then applies the ownership or mode change to the redirected inode, letting the attacker have root alter arbitrary host directories, with potential for privilege escalation (CVSS 3.1: 7.8 high, local vector). Any Linux system running an affected util-linux that exposes user-mountable fstab bind entries is affected. No public proof-of-concept, CISA KEV listing, or in-the-wild exploitation is known; EPSS estimates only a 0.1% probability of exploitation within 30 days.
What to do: Upgrade to util-linux 2.42.3, which contains the fix. Until patched, audit /etc/fstab for user-mountable bind mount entries — especially any using X-mount.owner, X-mount.group, or X-mount.mode — and ensure their source paths and all ancestor directories are not writable by untrusted local users, or remove the X-mount.* options from those entries.
| Product | Affected |
|---|---|
| util-linux project (CNA: Red Hat) util-linux (mount(8)) | versions prior to 2.42.3 (fixes included in util-linux 2.42.3) |
Estimated exposure
unknown — the vulnerable code likely ships on millions of Linux systems, but only a small fraction use the required fstab configuration — util-linux is present on virtually every Linux distribution, but exploitation additionally requires user-mountable fstab bind entries whose source is replaceable by untrusted users and, for full impact, X-mount.owner/group/mode options — a…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.
- Weakness
- CWE-367
- Vector
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H