Vulnerability fixes in util-linux-2.42.3
util-linux 2.42.3 patches mount(8) flaws CVE-2026-76642 and CVE-2026-78410, which allow privileged operations after mount helper failure.
util-linux 2.42.3 ships security fixes for two mount(8) vulnerabilities. CVE-2026-76642 causes post-mount hooks (X-mount.idmap, X-mount.owner/group/mode) to run even when an external mount helper exits nonzero, permitting privileged operations on the pre-existing target filesystem. CVE-2026-78410 is a time-of-check-to-time-of-use (TOCTOU) issue in mount(8). No exploitation or PoC is mentioned in the release notes.
30