USN-8091-1
util-linux vulnerability
It was discovered that the util-linux su utility did not drop capabilities when being used with the --pty option. While not a security issue by itself, a local attacker could possibly use the su tool to exploit vulnerabilities in other applications.
What each source reports
OSV No score
util-linux vulnerability
It was discovered that the util-linux su utility did not drop capabilities when being used with the --pty option. While not a security issue by itself, a local attacker could possibly use the su tool to exploit vulnerabilities in other applications.
- Record
USN-8091-1- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
util-linuxUbuntu:Pro:20.04:LTS |
before 2.34-0.1ubuntu9.6+esm1, plus listed versions 2.34-0.1ubuntu22.34-0.1ubuntu42.34-0.1ubuntu52.34-0.1ubuntu62.34-0.1ubuntu7 Show 7 moreShow less2.34-0.1ubuntu82.34-0.1ubuntu92.34-0.1ubuntu9.12.34-0.1ubuntu9.32.34-0.1ubuntu9.42.34-0.1ubuntu9.52.34-0.1ubuntu9.6 |
2.34-0.1ubuntu9.6+esm1 |
util-linuxUbuntu:22.04:LTS |
before 2.37.2-4ubuntu3.5, plus listed versions 2.36.1-8ubuntu12.37.2-4ubuntu12.37.2-4ubuntu22.37.2-4ubuntu32.37.2-4ubuntu3.32.37.2-4ubuntu3.4 |
2.37.2-4ubuntu3.5 |
util-linuxUbuntu:24.04:LTS |
before 2.39.3-9ubuntu6.5, plus listed versions 2.39.1-4ubuntu22.39.2-6ubuntu12.39.3-6ubuntu22.39.3-9ubuntu22.39.3-9ubuntu4 Show 5 moreShow less2.39.3-9ubuntu62.39.3-9ubuntu6.12.39.3-9ubuntu6.22.39.3-9ubuntu6.32.39.3-9ubuntu6.4 |
2.39.3-9ubuntu6.5 |
util-linuxUbuntu:25.10 |
before 2.41-4ubuntu4.2, plus listed versions 2.40.2-14ubuntu12.41-4ubuntu22.41-4ubuntu32.41-4ubuntu42.41-4ubuntu4.1 |
2.41-4ubuntu4.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
USN-8091-1 is a vulnerability with no CVSS score yet in util-linux, published March 12, 2026. No source lists public exploit code. Fixed in util-linux 2.34-0.1ubuntu9.6+esm1.