CVE-2026-53615

The util-linux package contains a random collection of files that implements some low-level basic linux utilities.

Security Fix(es):

util-linux is a random collection of Linux utilities. Before util-linux 2.41.4, parse_dos_extended() in libblkid/src/partitions/dos.c computes an extended-partition start sector with 32-bit addition and does not apply the extended-area bounds checks to the first two EBR entries. A local attacker who causes a crafted DOS extended-partition disk image or removable medium to be probed can wrap cur_start + start to sector zero and cause libblkid to report a false partition overlapping the MBR. This directly compromises the integrity of the reported partition metadata; disk modification or availability loss requires a separate downstream consumer to act on that metadata. This issue is fixed in 2.41.4.(CVE-2026-53615)

The util-linux package contains a random collection of files that implements some low-level basic linux utilities.

Security Fix(es):

util-linux is a random collection of Linux utilities. Before util-linux 2.41.4, parse_dos_extended() in libblkid/src/partitions/dos.c computes an extended-partition start sector with 32-bit addition and does not apply the extended-area bounds checks to the first two EBR entries. A local attacker who causes a crafted DOS extended-partition disk image or removable medium to be probed can wrap cur_start + start to sector zero and cause libblkid to report a false partition overlapping the MBR. This directly compromises the integrity of the reported partition metadata; disk modification or availability loss requires a separate downstream consumer to act on that metadata. This issue is fixed in 2.41.4.(CVE-2026-53615)

The util-linux package contains a random collection of files that implements some low-level basic linux utilities.

Security Fix(es):

util-linux is a random collection of Linux utilities. Before util-linux 2.41.4, parse_dos_extended() in libblkid/src/partitions/dos.c computes an extended-partition start sector with 32-bit addition and does not apply the extended-area bounds checks to the first two EBR entries. A local attacker who causes a crafted DOS extended-partition disk image or removable medium to be probed can wrap cur_start + start to sector zero and cause libblkid to report a false partition overlapping the MBR. This directly compromises the integrity of the reported partition metadata; disk modification or availability loss requires a separate downstream consumer to act on that metadata. This issue is fixed in 2.41.4.(CVE-2026-53615)

The util-linux package contains a random collection of files that implements some low-level basic linux utilities.

Security Fix(es):

util-linux is a random collection of Linux utilities. Before util-linux 2.41.4, parse_dos_extended() in libblkid/src/partitions/dos.c computes an extended-partition start sector with 32-bit addition and does not apply the extended-area bounds checks to the first two EBR entries. A local attacker who causes a crafted DOS extended-partition disk image or removable medium to be probed can wrap cur_start + start to sector zero and cause libblkid to report a false partition overlapping the MBR. This directly compromises the integrity of the reported partition metadata; disk modification or availability loss requires a separate downstream consumer to act on that metadata. This issue is fixed in 2.41.4.(CVE-2026-53615)

The util-linux packages contain a large variety of low-level system utilities that are necessary for a Linux system to function. Among others, these include the fdisk configuration tool and the login program.

Security Fix(es):

• util-linux: TOCTOU in the mount program when setting up loop devices (CVE-2026-27456)

• util-linux: util-linux: heap use-after-free in libblkid nested partition probing (CVE-2026-13595)

• util-linux: TOCTOU in the mount program via ancestor directory swap on target path (CVE-2026-53613)

• util-linux: util-linux: TOCTOU in the mount program when applying post-mount ownership/mode changes (CVE-2026-53612)

• util-linux: util-linux: SUID mount(8) allows nosuid/noexec bypass via LIBMOUNT_FORCE_MOUNT2 (CVE-2026-53614)

• util-linux: util-linux: failed external mount helper still runs privileged X-mount post-hooks (CVE-2026-76642)

• util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority (CVE-2026-78408)

• util-linux: util-linux: restricted bind mounts do not pin the source, allowing X-mount.owner/group/mode redirection (CVE-2026-78410)

• util-linux: util-linux: Partition metadata compromise via integer overflow in DOS partition parser (CVE-2026-53615)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

util-linux is a random collection of Linux utilities. Before util-linux 2.41.4, parse_dos_extended() in libblkid/src/partitions/dos.c computes an extended-partition start sector with 32-bit addition and does not apply the extended-area bounds checks to the first two EBR entries. A local attacker who causes a crafted DOS extended-partition disk image or removable medium to be probed can wrap cur_start + start to sector zero and cause libblkid to report a false partition overlapping the MBR. This directly compromises the integrity of the reported partition metadata; disk modification or availability loss requires a separate downstream consumer to act on that metadata. This issue is fixed in 2.41.4.

The util-linux packages contain a large variety of low-level system utilities that are necessary for a Linux system to function. Among others, these include the fdisk configuration tool and the login program.

Security Fix(es):

• util-linux: TOCTOU in the mount program when setting up loop devices (CVE-2026-27456)
• util-linux: util-linux: heap use-after-free in libblkid nested partition probing (CVE-2026-13595)
• util-linux: TOCTOU in the mount program via ancestor directory swap on target path (CVE-2026-53613)
• util-linux: util-linux: TOCTOU in the mount program when applying post-mount ownership/mode changes (CVE-2026-53612)
• util-linux: util-linux: SUID mount(8) allows nosuid/noexec bypass via LIBMOUNT_FORCE_MOUNT2 (CVE-2026-53614)
• util-linux: util-linux: failed external mount helper still runs privileged X-mount post-hooks (CVE-2026-76642)
• util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority (CVE-2026-78408)
• util-linux: util-linux: restricted bind mounts do not pin the source, allowing X-mount.owner/group/mode redirection (CVE-2026-78410)
• util-linux: util-linux: Partition metadata compromise via integer overflow in DOS partition parser (CVE-2026-53615)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

util-linux is a random collection of Linux utilities. Before util-linux 2.41.4, parse_dos_extended() in libblkid/src/partitions/dos.c computes an extended-partition start sector with 32-bit addition and does not apply the extended-area bounds checks to the first two EBR entries. A local attacker who causes a crafted DOS extended-partition disk image or removable medium to be probed can wrap cur_start + start to sector zero and cause libblkid to report a false partition overlapping the MBR. This directly compromises the integrity of the reported partition metadata; disk modification or availability loss requires a separate downstream consumer to act on that metadata. This issue is fixed in 2.41.4.

Root has patched CVE-2026-53615 in the util-linux package for Root:Debian:11. Multiple fixed versions available.

Root has patched CVE-2026-53615 in the util-linux package for Root:Debian:12. Multiple fixed versions available.

Root has patched CVE-2026-53615 in the util-linux package for Root:Debian:13. Multiple fixed versions available.

It was discovered that libblkid in util-linux had a heap use-after-free vulnerability during nested partition probing. An attacker who could present a crafted block device image could possibly use this issue to obtain sensitive information or cause a denial of service. (CVE-2026-13595)

It was discovered that the mount utility in util-linux had a time-of-check- time-of-use vulnerability when setting up loop devices. A local attacker could possibly use this issue to obtain unauthorized read access to root- protected files and block devices. (CVE-2026-27456)

It was discovered that the login utility in util-linux improperly canonicalized hostnames when invoked with the -h option. A remote attacker could possibly use this issue to bypass host-based access control rules. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-3184)

It was discovered that libmount in util-linux had a time-of-check-time-of- use vulnerability in its ownership hook. A local attacker could possibly use this issue to gain elevated privileges. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-53612)

It was discovered that libmount in util-linux had a time-of-check-time-of- use vulnerability that allowed target path redirection during mount operations. A local attacker could possibly use this issue to gain elevated privileges. (CVE-2026-53613)

It was discovered that libmount in util-linux improperly handled the LIBMOUNT_FORCE_MOUNT2 environment variable in the SUID mount utility. A local attacker could possibly use this issue to bypass nosuid and noexec mount options and gain elevated privileges. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-53614)

It was discovered that libblkid in util-linux had an integer overflow vulnerability when parsing DOS partition tables. An attacker who could present a crafted block device image could possibly use this issue to cause a denial of service. (CVE-2026-53615)