CVE-2026-3184
Util-linux: util-linux: access control bypass due to improper hostname canonicalization
A flaw was found in util-linux. Improper hostname canonicalization in the login(1) utility, when invoked with the -h option, can modify the supplied remote hostname before setting PAM_RHOST. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Util-linux: util-linux: access control bypass due to improper hostname canonicalization
A flaw was found in util-linux. Improper hostname canonicalization in the login(1) utility, when invoked with the -h option, can modify the supplied remote hostname before setting PAM_RHOST. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.
- Record
CVE-2026-3184- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-289
- Updated
- 2026-11-06
EUVDEUVD-2026-18817
A flaw was found in util-linux. Improper hostname canonicalization in the login(1) utility, when invoked with the -h option, can modify the supplied remote hostname before setting PAM_RHOST. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.
- Record
EUVD-2026-18817- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-06
GitHub AdvisoriesGHSA-qp7r-5rpf-pwxg
A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility,...
A flaw was found in util-linux. Improper hostname canonicalization in the login(1) utility, when invoked with the -h option, can modify the supplied remote hostname before setting PAM_RHOST. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.
- Record
GHSA-qp7r-5rpf-pwxg- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-289
- Updated
- 2026-11-02
NVD
A flaw was found in util-linux. Improper hostname canonicalization in the login(1) utility, when invoked with the -h option, can modify the supplied remote hostname before setting PAM_RHOST. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.
- Record
CVE-2026-3184- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-289
- Updated
- 2026-11-06
OSVBELL-CVE-2026-3184
- Record
BELL-CVE-2026-3184- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-3184
A flaw was found in util-linux. Improper hostname canonicalization in the login(1) utility, when invoked with the -h option, can modify the supplied remote hostname before setting PAM_RHOST. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.
- Record
DEBIAN-CVE-2026-3184- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-07
Show 28 moreShow less
OSVOESA-2026-1532
util-linux security update
The util-linux package contains a random collection of files that implements some low-level basic linux utilities.
Security Fix(es):
A vulnerability exists in util-linux package that allows access control bypass due to improper hostname canonicalization.(CVE-2026-3184)
- Record
OESA-2026-1532- CVSS 3.1
- 5.6 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVOESA-2026-1533
util-linux security update
The util-linux package contains a random collection of files that implements some low-level basic linux utilities.
Security Fix(es):
A vulnerability exists in util-linux package that allows access control bypass due to improper hostname canonicalization.(CVE-2026-3184)
- Record
OESA-2026-1533- CVSS 3.1
- 5.6 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVOESA-2026-1534
util-linux security update
The util-linux package contains a random collection of files that implements some low-level basic linux utilities.
Security Fix(es):
A vulnerability exists in util-linux package that allows access control bypass due to improper hostname canonicalization.(CVE-2026-3184)
- Record
OESA-2026-1534- CVSS 3.1
- 5.6 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVOESA-2026-1535
util-linux security update
The util-linux package contains a random collection of files that implements some low-level basic linux utilities.
Security Fix(es):
A vulnerability exists in util-linux package that allows access control bypass due to improper hostname canonicalization.(CVE-2026-3184)
- Record
OESA-2026-1535- CVSS 3.1
- 5.6 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVOESA-2026-1633
util-linux security update
The util-linux package contains a random collection of files that implements some low-level basic linux utilities.
Security Fix(es):
A vulnerability exists in util-linux package that allows access control bypass due to improper hostname canonicalization.(CVE-2026-3184)
- Record
OESA-2026-1633- CVSS 3.1
- 5.6 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVOESA-2026-1634
util-linux security update
The util-linux package contains a random collection of files that implements some low-level basic linux utilities.
Security Fix(es):
A vulnerability exists in util-linux package that allows access control bypass due to improper hostname canonicalization.(CVE-2026-3184)
- Record
OESA-2026-1634- CVSS 3.1
- 5.6 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVOESA-2026-1635
util-linux security update
The util-linux package contains a random collection of files that implements some low-level basic linux utilities.
Security Fix(es):
A vulnerability exists in util-linux package that allows access control bypass due to improper hostname canonicalization.(CVE-2026-3184)
- Record
OESA-2026-1635- CVSS 3.1
- 5.6 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVOESA-2026-1636
util-linux security update
The util-linux package contains a random collection of files that implements some low-level basic linux utilities.
Security Fix(es):
A vulnerability exists in util-linux package that allows access control bypass due to improper hostname canonicalization.(CVE-2026-3184)
- Record
OESA-2026-1636- CVSS 3.1
- 5.6 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVRHSA-2026:7180
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
- Record
RHSA-2026:7180- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H - Updated
- 2026-11-02
OSVROOT-OS-DEBIAN-12-CVE-2026-3184
CVE-2026-3184 in util-linux - Patched by Root
Root has patched CVE-2026-3184 in the util-linux package for Root:Debian:12. Multiple fixed versions available.
- Record
ROOT-OS-DEBIAN-12-CVE-2026-3184- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVROOT-OS-DEBIAN-13-CVE-2026-3184
CVE-2026-3184 in util-linux - Patched by Root
Root has patched CVE-2026-3184 in the util-linux package for Root:Debian:13. Multiple fixed versions available.
- Record
ROOT-OS-DEBIAN-13-CVE-2026-3184- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-3184
A flaw was found in util-linux. Improper hostname canonicalization in the login(1) utility, when invoked with the -h option, can modify the supplied remote hostname before setting PAM_RHOST. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.
- Record
UBUNTU-CVE-2026-3184- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVAZL-81911 No score
CVE-2026-3184 affecting package util-linux for versions less than 2.40.2-4
A flaw was found in util-linux. Improper hostname canonicalization in the login(1) utility, when invoked with the -h option, can modify the supplied remote hostname before setting PAM_RHOST. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.
- Record
AZL-81911- Updated
- 2026-11-05
OSVCLSA-2026-1782982174 No score
util-linux: Fix of 4 CVEs
- CVE-2024-28085: wall: fix escape sequence injection in argv messages by sanitizing characters through buf_putc_careful(), preventing arbitrary text injection into other users' terminals (WallEscape)
- CVE-2026-3184: login: use original FQDN for PAM_RHOST to prevent hostname canonicalization from bypassing host-based PAM access control rules
- Record
CLSA-2026-1782982174- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:10288-1 No score
libblkid-devel-2.41.3-4.1 on GA media
These are all security issues fixed in the libblkid-devel-2.41.3-4.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:10288-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:20495-1 No score
Security update for util-linux
This update for util-linux fixes the following issues:
Security issues:
- CVE-2025-14104: heap buffer overread in setpwnam() when processing 256-byte usernames (bsc#1254666).
- CVE-2026-3184: access control bypass due to improper hostname canonicalization in
login(bsc#1258859).
Non security issues:
- fdisk: Fix possible partition overlay and data corruption if EBR gap is missing (bsc#1222465).
- lscpu: Add support for NVIDIA Olympus arm64 core (jsc#PED-13682).
- Record
openSUSE-SU-2026:20495-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:0803-1 No score
Security update for util-linux
This update for util-linux fixes the following issues:
- CVE-2026-3184: Fix full hostname usage for PAM to ensure correct access control for 'login -h' (bsc#1258859).
- Record
SUSE-SU-2026:0803-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:0856-1 No score
Security update for util-linux
This update for util-linux fixes the following issues:
- CVE-2026-3184: Fix full hostname usage for PAM to ensure correct access control for 'login -h' (bsc#1258859).
- Record
SUSE-SU-2026:0856-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:0857-1 No score
Security update for util-linux
This update for util-linux fixes the following issues:
- CVE-2026-3184: Fix full hostname usage for PAM to ensure correct access control for 'login -h' (bsc#1258859).
- Record
SUSE-SU-2026:0857-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:0982-1 No score
Security update for util-linux
This update for util-linux fixes the following issues:
- CVE-2026-3184: Fix full hostname usage for PAM to ensure correct access control for 'login -h' (bsc#1258859).
- Record
SUSE-SU-2026:0982-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:0987-1 No score
Security update for util-linux
This update for util-linux fixes the following issues:
Security issue:
- CVE-2026-3184: access control bypass due to improper hostname canonicalization in
login(bsc#1258859).
Non security issues:
- recognize fuse 'portal' as a virtual file system (bsc#1234736).
- fdisk: fix possible partition overlay and data corruption if EBR gap is missing (bsc#1222465).
- Record
SUSE-SU-2026:0987-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:1370-1 No score
Security update for util-linux
This update for util-linux fixes the following issues:
- CVE-2026-3184: Fix full hostname usage for PAM to ensure correct access control for 'login -h' (bsc#1258859).
- Record
SUSE-SU-2026:1370-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:1406-1 No score
Security update for util-linux
This update for util-linux fixes the following issues:
Security issue:
- CVE-2026-3184: access control bypass due to improper hostname canonicalization in
login(bsc#1258859).
Non security issues:
- recognize fuse 'portal' as a virtual file system (bsc#1234736).
- fdisk: fix possible partition overlay and data corruption if EBR gap is missing (bsc#1222465).
- Record
SUSE-SU-2026:1406-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:20664-1 No score
Security update for util-linux
This update for util-linux fixes the following issue:
- CVE-2026-3184: access control bypass due to improper hostname canonicalization in
login(bsc#1258859).
- Record
SUSE-SU-2026:20664-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:20714-1 No score
Security update for util-linux
This update for util-linux fixes the following issue:
- CVE-2026-3184: access control bypass due to improper hostname canonicalization in
login(bsc#1258859).
- Record
SUSE-SU-2026:20714-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:21016-1 No score
Security update for util-linux
This update for util-linux fixes the following issues:
Security issues:
- CVE-2025-14104: heap buffer overread in setpwnam() when processing 256-byte usernames (bsc#1254666).
- CVE-2026-3184: access control bypass due to improper hostname canonicalization in
login(bsc#1258859).
Non security issues:
- fdisk: Fix possible partition overlay and data corruption if EBR gap is missing (bsc#1222465).
- lscpu: Add support for NVIDIA Olympus arm64 core (jsc#PED-13682).
- Record
SUSE-SU-2026:21016-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:21158-1 No score
Security update for util-linux
This update for util-linux fixes the following issues:
Security issues:
- CVE-2025-14104: heap buffer overread in setpwnam() when processing 256-byte usernames (bsc#1254666).
- CVE-2026-3184: access control bypass due to improper hostname canonicalization in
login(bsc#1258859).
Non security issues:
- fdisk: Fix possible partition overlay and data corruption if EBR gap is missing (bsc#1222465).
- lscpu: Add support for NVIDIA Olympus arm64 core (jsc#PED-13682).
- Record
SUSE-SU-2026:21158-1- Updated
- 2026-11-02
OSVUSN-8702-1 No score
util-linux vulnerabilities
It was discovered that libblkid in util-linux had a heap use-after-free vulnerability during nested partition probing. An attacker who could present a crafted block device image could possibly use this issue to obtain sensitive information or cause a denial of service. (CVE-2026-13595)
It was discovered that the mount utility in util-linux had a time-of-check- time-of-use vulnerability when setting up loop devices. A local attacker could possibly use this issue to obtain unauthorized read access to root- protected files and block devices. (CVE-2026-27456)
It was discovered that the login utility in util-linux improperly canonicalized hostnames when invoked with the -h option. A remote attacker could possibly use this issue to bypass host-based access control rules. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-3184)
It was discovered that libmount in util-linux had a time-of-check-time-of- use vulnerability in its ownership hook. A local attacker could possibly use this issue to gain elevated privileges. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-53612)
It was discovered that libmount in util-linux had a time-of-check-time-of- use vulnerability that allowed target path redirection during mount operations. A local attacker could possibly use this issue to gain elevated privileges. (CVE-2026-53613)
It was discovered that libmount in util-linux improperly handled the LIBMOUNT_FORCE_MOUNT2 environment variable in the SUID mount utility. A local attacker could possibly use this issue to bypass nosuid and noexec mount options and gain elevated privileges. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-53614)
It was discovered that libblkid in util-linux had an integer overflow vulnerability when parsing DOS partition tables. An attacker who could present a crafted block device image could possibly use this issue to cause a denial of service. (CVE-2026-53615)
- Record
USN-8702-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
util-linuxAzure Linux:3 |
before 2.40.2-4 | 2.40.2-4 |
util-linuxAlpaquita:23 |
2.38.1-r2 up to 2.38.1-r6 | 2.38.1-r6 |
util-linuxAlpaquita:25 |
2.41-r6 up to 2.41-r8 | 2.41-r8 |
util-linuxAlpaquita:stream |
2.39-r14 up to 2.41.3-r1 | 2.41.3-r1 |
util-linuxBellSoft Hardened Containers:23 |
2.38.1-r2 up to 2.38.1-r6 | 2.38.1-r6 |
util-linuxBellSoft Hardened Containers:25 |
2.41-r6 up to 2.41-r8 | 2.41-r8 |
util-linuxBellSoft Hardened Containers:stream |
2.39-r14 up to 2.41.3-r1 | 2.41.3-r1 |
libblkidTuxCare:AlmaLinux:9.2 From an advisory covering 2 CVEs |
before 2.37.4-11.el9_2.tuxcare.els3 | 2.37.4-11.el9_2.tuxcare.els3 |
libblkid-develTuxCare:AlmaLinux:9.2 From an advisory covering 2 CVEs |
before 2.37.4-11.el9_2.tuxcare.els3 | 2.37.4-11.el9_2.tuxcare.els3 |
libfdiskTuxCare:AlmaLinux:9.2 From an advisory covering 2 CVEs |
before 2.37.4-11.el9_2.tuxcare.els3 | 2.37.4-11.el9_2.tuxcare.els3 |
Show 72 moreShow less
| Package | Affected | Fixed |
|---|---|---|
libfdisk-develTuxCare:AlmaLinux:9.2 From an advisory covering 2 CVEs |
before 2.37.4-11.el9_2.tuxcare.els3 | 2.37.4-11.el9_2.tuxcare.els3 |
libmountTuxCare:AlmaLinux:9.2 From an advisory covering 2 CVEs |
before 2.37.4-11.el9_2.tuxcare.els3 | 2.37.4-11.el9_2.tuxcare.els3 |
libmount-develTuxCare:AlmaLinux:9.2 From an advisory covering 2 CVEs |
before 2.37.4-11.el9_2.tuxcare.els3 | 2.37.4-11.el9_2.tuxcare.els3 |
libsmartcolsTuxCare:AlmaLinux:9.2 From an advisory covering 2 CVEs |
before 2.37.4-11.el9_2.tuxcare.els3 | 2.37.4-11.el9_2.tuxcare.els3 |
libsmartcols-develTuxCare:AlmaLinux:9.2 From an advisory covering 2 CVEs |
before 2.37.4-11.el9_2.tuxcare.els3 | 2.37.4-11.el9_2.tuxcare.els3 |
libuuidTuxCare:AlmaLinux:9.2 From an advisory covering 2 CVEs |
before 2.37.4-11.el9_2.tuxcare.els3 | 2.37.4-11.el9_2.tuxcare.els3 |
libuuid-develTuxCare:AlmaLinux:9.2 From an advisory covering 2 CVEs |
before 2.37.4-11.el9_2.tuxcare.els3 | 2.37.4-11.el9_2.tuxcare.els3 |
python3-libmountTuxCare:AlmaLinux:9.2 From an advisory covering 2 CVEs |
before 2.37.4-11.el9_2.tuxcare.els3 | 2.37.4-11.el9_2.tuxcare.els3 |
util-linuxTuxCare:AlmaLinux:9.2 From an advisory covering 2 CVEs |
before 2.37.4-11.el9_2.tuxcare.els3 | 2.37.4-11.el9_2.tuxcare.els3 |
util-linux-coreTuxCare:AlmaLinux:9.2 From an advisory covering 2 CVEs |
before 2.37.4-11.el9_2.tuxcare.els3 | 2.37.4-11.el9_2.tuxcare.els3 |
util-linux-userTuxCare:AlmaLinux:9.2 From an advisory covering 2 CVEs |
before 2.37.4-11.el9_2.tuxcare.els3 | 2.37.4-11.el9_2.tuxcare.els3 |
uuiddTuxCare:AlmaLinux:9.2 From an advisory covering 2 CVEs |
before 2.37.4-11.el9_2.tuxcare.els3 | 2.37.4-11.el9_2.tuxcare.els3 |
util-linuxDebian:12 |
All versions, plus listed versions 2.38.1-52.38.1-5+deb12u12.38.1-5+deb12u22.38.1-5+deb12u32.38.1-5+loong64 Show 45 moreShow less2.38.1-62.39.1-12.39.1-22.39.1-32.39.1-42.39.2-12.39.2-22.39.2-2.12.39.2-2.22.39.2-32.39.2-42.39.2-52.39.2-62.39.3-12.39.3-102.39.3-112.39.3-22.39.3-32.39.3-42.39.3-52.39.3-62.39.3-6.12.39.3-6.1~exp12.39.3-72.39.3-82.39.3-92.40-12.40-22.40-32.40-42.40-52.40-62.40-72.40-82.40.1-12.40.1-22.40.1-32.40.1-42.40.1-4+hurd.12.40.1-62.40.1-72.40.1-82.40.1-8.12.40.1-92.40.2-1 |
None known |
util-linuxDebian:13 |
All versions, plus listed versions 2.41-52.41.1-12.41.1-22.41.1-32.41.1-4 Show 31 moreShow less2.41.2-12.41.2-22.41.2-32.41.2-42.41.3-12.41.3-22.41.3-32.41.3-42.41.5-0+deb13u12.42-12.42-22.42-32.42-42.42-52.42-62.42.1-12.42.1-22.42.1-32.42.1-42.42.1-52.42.1-62.42.2-12.42.2-22.42.2-32.42.2-42.42.3-12.42.4-12.42~rc1-12.42~rc1-22.42~rc1-32.42~rc2-1 |
None known |
util-linuxDebian:14 |
before 2.42-1, plus listed versions 2.41-52.41.1-12.41.1-22.41.1-32.41.1-4 Show 12 moreShow less2.41.2-12.41.2-22.41.2-32.41.2-42.41.3-12.41.3-22.41.3-32.41.3-42.42~rc1-12.42~rc1-22.42~rc1-32.42~rc2-1 |
2.42-1 |
util-linuxopenEuler:24.03-LTS |
before 2.39.1-35.oe2403 | 2.39.1-35.oe2403 |
util-linuxopenEuler:24.03-LTS-SP1 |
before 2.39.1-35.oe2403sp1 | 2.39.1-35.oe2403sp1 |
util-linuxopenEuler:24.03-LTS-SP2 |
before 2.39.1-35.oe2403sp2 | 2.39.1-35.oe2403sp2 |
util-linuxopenEuler:24.03-LTS-SP3 |
before 2.39.1-35.oe2403sp3 | 2.39.1-35.oe2403sp3 |
util-linuxopenEuler:20.03-LTS-SP4 |
before 2.35.2-28.oe2003sp4 | 2.35.2-28.oe2003sp4 |
util-linuxopenEuler:22.03-LTS-SP4 |
before 2.37.2-50.oe2203sp4 | 2.37.2-50.oe2203sp4 |
util-linuxRed Hat:hummingbird:1 From an advisory covering 3 CVEs |
before 0:2.42-7.1.hum1 | 0:2.42-7.1.hum1 |
util-linux-coreRed Hat:hummingbird:1 From an advisory covering 3 CVEs |
before 0:2.42-7.1.hum1 | 0:2.42-7.1.hum1 |
util-linux-i18nRed Hat:hummingbird:1 From an advisory covering 3 CVEs |
before 0:2.42-7.1.hum1 | 0:2.42-7.1.hum1 |
util-linux-scriptRed Hat:hummingbird:1 From an advisory covering 3 CVEs |
before 0:2.42-7.1.hum1 | 0:2.42-7.1.hum1 |
util-linuxRoot:Debian:12 |
before 2.38.1-5+deb12u3.aikido.6 | 2.38.1-5+deb12u3.aikido.62.38.1-5+deb12u3.aikido.172.38.1-5+deb12u3.aikido.72.38.1-5+deb12u3.root.io.52.38.1-5+deb12u3.root.io.42.38.1-5+deb12u3.aikido.82.38.1-5+deb12u3.aikido.182.38.1-5+deb12u3.aikido.92.38.1-5+deb12u3.aikido.102.38.1-5+deb12u3.aikido.112.38.1-5+deb12u3.aikido.122.38.1-5+deb12u3.aikido.132.38.1-5+deb12u3.aikido.142.38.1-5+deb12u3.aikido.152.38.1-5+deb12u3.aikido.16 |
rootio-util-linuxRoot:Debian:12 |
before 2.38.1-5+deb12u3.aikido.6 | 2.38.1-5+deb12u3.aikido.62.38.1-5+deb12u3.aikido.172.38.1-5+deb12u3.aikido.72.38.1-5+deb12u3.root.io.52.38.1-5+deb12u3.root.io.42.38.1-5+deb12u3.aikido.82.38.1-5+deb12u3.aikido.182.38.1-5+deb12u3.aikido.92.38.1-5+deb12u3.aikido.102.38.1-5+deb12u3.aikido.112.38.1-5+deb12u3.aikido.122.38.1-5+deb12u3.aikido.132.38.1-5+deb12u3.aikido.142.38.1-5+deb12u3.aikido.152.38.1-5+deb12u3.aikido.16 |
util-linuxRoot:Debian:13 |
before 2.41.5-0+deb13u1.aikido.14 | 2.41.5-0+deb13u1.aikido.142.41.5-0+deb13u1.aikido.72.41.5-0+deb13u1.aikido.82.41.5-0+deb13u1.aikido.92.41.5-0+deb13u1.aikido.102.41.5-0+deb13u1.aikido.112.41.5-0+deb13u1.aikido.152.41.5-0+deb13u1.aikido.122.41.5-0+deb13u1.aikido.13 |
rootio-util-linuxRoot:Debian:13 |
before 2.41.5-0+deb13u1.aikido.14 | 2.41.5-0+deb13u1.aikido.142.41.5-0+deb13u1.aikido.72.41.5-0+deb13u1.aikido.82.41.5-0+deb13u1.aikido.92.41.5-0+deb13u1.aikido.102.41.5-0+deb13u1.aikido.112.41.5-0+deb13u1.aikido.152.41.5-0+deb13u1.aikido.122.41.5-0+deb13u1.aikido.13 |
python-libmountopenSUSE:Leap 15.6 |
before 2.39.3-150600.4.18.1 | 2.39.3-150600.4.18.1 |
util-linuxopenSUSE:Leap 15.6 |
before 2.39.3-150600.4.18.1 | 2.39.3-150600.4.18.1 |
util-linux-systemdopenSUSE:Leap 15.6 |
before 2.39.3-150600.4.18.1 | 2.39.3-150600.4.18.1 |
util-linuxSUSE:Linux Enterprise Micro 5.5 |
before 2.37.4-150500.9.23.1 | 2.37.4-150500.9.23.1 |
util-linux-systemdSUSE:Linux Enterprise Micro 5.5 |
before 2.37.4-150500.9.23.1 | 2.37.4-150500.9.23.1 |
python3-libmountopenSUSE:Leap 15.6 |
before 2.37.4-150500.9.23.1 | 2.37.4-150500.9.23.1 |
util-linuxopenSUSE:Leap 15.6 |
before 2.37.4-150500.9.23.1 | 2.37.4-150500.9.23.1 |
util-linuxSUSE:Linux Enterprise Micro 5.2 |
before 2.36.2-150300.4.53.1 | 2.36.2-150300.4.53.1 |
util-linux-systemdSUSE:Linux Enterprise Micro 5.2 |
before 2.36.2-150300.4.53.1 | 2.36.2-150300.4.53.1 |
util-linuxSUSE:Linux Enterprise Micro 5.3 |
before 2.37.2-150400.8.41.1 | 2.37.2-150400.8.41.1 |
util-linux-systemdSUSE:Linux Enterprise Micro 5.3 |
before 2.37.2-150400.8.41.1 | 2.37.2-150400.8.41.1 |
util-linuxSUSE:Linux Enterprise Micro 5.4 |
before 2.37.2-150400.8.41.1 | 2.37.2-150400.8.41.1 |
util-linux-systemdSUSE:Linux Enterprise Micro 5.4 |
before 2.37.2-150400.8.41.1 | 2.37.2-150400.8.41.1 |
util-linuxSUSE:Linux Enterprise Micro 5.2 |
before 2.36.2-150300.4.58.1 | 2.36.2-150300.4.58.1 |
util-linux-systemdSUSE:Linux Enterprise Micro 5.2 |
before 2.36.2-150300.4.58.1 | 2.36.2-150300.4.58.1 |
python-libmountSUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 |
before 2.33.2-4.51.2 | 2.33.2-4.51.2 |
util-linuxSUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 |
before 2.33.2-4.51.1 | 2.33.2-4.51.1 |
util-linux-systemdSUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 |
before 2.33.2-4.51.1 | 2.33.2-4.51.1 |
util-linuxSUSE:Linux Enterprise Module for Basesystem 15 SP7 |
before 2.40.4-150700.4.10.1 | 2.40.4-150700.4.10.1 |
util-linux-systemdSUSE:Linux Enterprise Module for Basesystem 15 SP7 |
before 2.40.4-150700.4.10.1 | 2.40.4-150700.4.10.1 |
util-linux-systemdSUSE:Linux Enterprise Module for Server Applications 15 SP7 |
before 2.40.4-150700.4.10.1 | 2.40.4-150700.4.10.1 |
util-linuxSUSE:Linux Micro 6.1 |
before 2.40.4-slfo.1.1_4.1 | 2.40.4-slfo.1.1_4.1 |
util-linux-systemdSUSE:Linux Micro 6.1 |
before 2.40.4-slfo.1.1_4.1 | 2.40.4-slfo.1.1_4.1 |
util-linuxSUSE:Linux Micro 6.0 |
before 2.39.3-5.1 | 2.39.3-5.1 |
util-linux-systemdSUSE:Linux Micro 6.0 |
before 2.39.3-5.1 | 2.39.3-5.1 |
util-linuxSUSE:Linux Micro 6.2 From an advisory covering 2 CVEs |
before 2.41.1-160000.3.1 | 2.41.1-160000.3.1 |
util-linux-systemdSUSE:Linux Micro 6.2 From an advisory covering 2 CVEs |
before 2.41.1-160000.3.1 | 2.41.1-160000.3.1 |
python-libmountSUSE:Linux Enterprise Server 16.0 From an advisory covering 2 CVEs |
before 2.41.1-160000.3.1 | 2.41.1-160000.3.1 |
util-linuxSUSE:Linux Enterprise Server 16.0 From an advisory covering 2 CVEs |
before 2.41.1-160000.3.1 | 2.41.1-160000.3.1 |
util-linux-systemdSUSE:Linux Enterprise Server 16.0 From an advisory covering 2 CVEs |
before 2.41.1-160000.3.1 | 2.41.1-160000.3.1 |
python-libmountSUSE:Linux Enterprise Server for SAP applications 16.0 From an advisory covering 2 CVEs |
before 2.41.1-160000.3.1 | 2.41.1-160000.3.1 |
util-linuxSUSE:Linux Enterprise Server for SAP applications 16.0 From an advisory covering 2 CVEs |
before 2.41.1-160000.3.1 | 2.41.1-160000.3.1 |
util-linux-systemdSUSE:Linux Enterprise Server for SAP applications 16.0 From an advisory covering 2 CVEs |
before 2.41.1-160000.3.1 | 2.41.1-160000.3.1 |
util-linuxUbuntu:25.10 |
All versions, plus listed versions 2.40.2-14ubuntu12.41-4ubuntu22.41-4ubuntu32.41-4ubuntu42.41-4ubuntu4.12.41-4ubuntu4.2 |
None known |
util-linuxUbuntu:26.10 |
All versions, plus listed versions 2.41.3-3ubuntu22.42.2-1ubuntu2 |
None known |
util-linuxUbuntu:26.04:LTS |
before 2.41.3-3ubuntu2.2, plus listed versions 2.41-4ubuntu42.41.2-4ubuntu12.41.2-4ubuntu22.41.2-4ubuntu32.41.3-3ubuntu12.41.3-3ubuntu2 |
2.41.3-3ubuntu2.2 |
util-linuxUbuntu:22.04:LTS From an advisory covering 7 CVEs |
before 2.37.2-4ubuntu3.6, plus listed versions 2.36.1-8ubuntu12.37.2-4ubuntu12.37.2-4ubuntu22.37.2-4ubuntu32.37.2-4ubuntu3.32.37.2-4ubuntu3.42.37.2-4ubuntu3.5 |
2.37.2-4ubuntu3.6 |
util-linuxUbuntu:24.04:LTS From an advisory covering 7 CVEs |
before 2.39.3-9ubuntu6.6, plus listed versions 2.39.1-4ubuntu22.39.2-6ubuntu12.39.3-6ubuntu22.39.3-9ubuntu22.39.3-9ubuntu4 Show 6 moreShow less2.39.3-9ubuntu62.39.3-9ubuntu6.12.39.3-9ubuntu6.22.39.3-9ubuntu6.32.39.3-9ubuntu6.42.39.3-9ubuntu6.5 |
2.39.3-9ubuntu6.6 |
util-linuxUbuntu:26.04:LTS From an advisory covering 7 CVEs |
before 2.41.3-3ubuntu2.2, plus listed versions 2.41-4ubuntu42.41.2-4ubuntu12.41.2-4ubuntu22.41.2-4ubuntu32.41.3-3ubuntu12.41.3-3ubuntu2 |
2.41.3-3ubuntu2.2 |
util-linuxopenSUSE:Tumbleweed |
before 2.41.3-4.1 | 2.41.3-4.1 |
python-libmountopenSUSE:Leap 16.0 From an advisory covering 2 CVEs |
before 2.41.1-160000.3.1 | 2.41.1-160000.3.1 |
util-linuxopenSUSE:Leap 16.0 From an advisory covering 2 CVEs |
before 2.41.1-160000.3.1 | 2.41.1-160000.3.1 |
util-linux-systemdopenSUSE:Leap 16.0 From an advisory covering 2 CVEs |
before 2.41.1-160000.3.1 | 2.41.1-160000.3.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-3184 is a low vulnerability (CVSS 3.7) in Kernel Util-linux, published March 3, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.44%, the 38th percentile. Fixed in util-linux 2.40.2-4.
References
access.redhat.com/errata/RHSA-2026:7180
bugzilla.redhat.com/show_bug.cgi?id=2442570
nvd.nist.gov/vuln/detail/CVE-2026-3184
github.com/advisories/GHSA-qp7r-5rpf-pwxg
docs.bell-sw.com/security/cves/CVE-2026-3184
Show 51 moreShow less
errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1782982174.html
security-tracker.debian.org/tracker/CVE-2026-3184
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2026-1532
images.redhat.com
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7180.json
cve.org/CVERecord?id=CVE-2025-14104
suse.com/support/update/announcement/2026/suse-su-20260803-1
bugzilla.suse.com/1258859
ubuntu.com/security/CVE-2026-3184
Left out here: 70 versions. The JSON record has them.