Vulnerability fixes in util-linux-2.42.3
util-linux 2.42.3 patches mount(8) flaws CVE-2026-76642 and CVE-2026-78410, which allow privileged operations after mount helper failure.
util-linux 2.42.3 ships security fixes for two mount(8) vulnerabilities. CVE-2026-76642 causes post-mount hooks (X-mount.idmap, X-mount.owner/group/mode) to run even when an external mount helper exits nonzero, permitting privileged operations on the pre-existing target filesystem. CVE-2026-78410 is a time-of-check-to-time-of-use (TOCTOU) issue in mount(8). No exploitation or PoC is mentioned in the release notes.
- CVE-2026-76642: post-mount hooks execute despite mount helper failure, enabling privileged operations on the target filesystem
- CVE-2026-78410: TOCTOU flaw in mount(8) also fixed in 2.42.3
- Fixes released in util-linux 2.42.3, announced by Sam James on oss-security
- Vendors
- util-linux
- Products
- util-linux 2.42.3
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-76642 | Missing Exit-Status Check in util-linux Mount Helpers Enables Local Privilege Escalation | 8.5 | <1% | ||
| CVE-2026-78410 | TOCTOU race in util-linux mount(8) lets local users redirect restricted bind mounts | 7.8 | <1% |
From the original article
Posted by Sam James on Sep 04 +util-linux 2. 42. 3 Release Notes +=============================== + +Security fixes: + + CVE-2026-76642 - mount(8) post-mount hooks execute after helper failure.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.