{"id":"CVE-2026-76642","aliases":["ALPINE-CVE-2026-76642","ALSA-2026:93461","AZL-99081","BELL-CVE-2026-76642","DEBIAN-CVE-2026-76642","EUVD-2026-70382","GHSA-m25x-3hj9-m26f","MGASA-2026-0560","OESA-2026-3722","OESA-2026-3723","OESA-2026-3981","RHSA-2026:63162","RLSA-2026:93461","ROOT-OS-DEBIAN-12-CVE-2026-76642","ROOT-OS-DEBIAN-13-CVE-2026-76642","SUSE-SU-2026:23861-1","SUSE-SU-2026:23870-1","SUSE-SU-2026:23884-1","UBUNTU-CVE-2026-76642","openSUSE-SU-2026:11870-1","openSUSE-SU-2026:21905-1"],"status":"published","title":"util-linux libmount Privilege Escalation via Failed Mount Helper","description":"util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.","severity":{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00216,"percentile":0.12044,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-390"],"published":"2026-09-03T10:54:08Z","modified":"2026-11-09T12:52:32Z","fixes":[{"ecosystem":"Alpine:v3.22","package":"util-linux","fixed_in":["2.41.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"util-linux","fixed_in":["2.41.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"util-linux","fixed_in":["2.42.3-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"util-linux","fixed_in":["2.40.2-6"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"util-linux","fixed_in":["2.41.6-r1"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"util-linux","fixed_in":["2.42.3-r1"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:25","package":"util-linux","fixed_in":["2.41.6-r1"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"util-linux","fixed_in":["2.42.3-r1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"util-linux","fixed_in":["2.42.3-1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"util-linux","fixed_in":["2.39.1-41.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP4","package":"util-linux","fixed_in":["2.39.1-41.oe2403sp4"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"util-linux","fixed_in":["2.38.1-5+deb12u3.aikido.17","2.38.1-5+deb12u3.aikido.18","2.38.1-5+deb12u3.aikido.9","2.38.1-5+deb12u3.aikido.10","2.38.1-5+deb12u3.aikido.11","2.38.1-5+deb12u3.aikido.12","2.38.1-5+deb12u3.aikido.13","2.38.1-5+deb12u3.aikido.14","2.38.1-5+deb12u3.aikido.15","2.38.1-5+deb12u3.aikido.16"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"rootio-util-linux","fixed_in":["2.38.1-5+deb12u3.aikido.17","2.38.1-5+deb12u3.aikido.18","2.38.1-5+deb12u3.aikido.9","2.38.1-5+deb12u3.aikido.10","2.38.1-5+deb12u3.aikido.11","2.38.1-5+deb12u3.aikido.12","2.38.1-5+deb12u3.aikido.13","2.38.1-5+deb12u3.aikido.14","2.38.1-5+deb12u3.aikido.15","2.38.1-5+deb12u3.aikido.16"],"sources":["osv"]},{"ecosystem":"Root:Debian:13","package":"util-linux","fixed_in":["2.41.5-0+deb13u1.aikido.14","2.41.5-0+deb13u1.aikido.7","2.41.5-0+deb13u1.aikido.8","2.41.5-0+deb13u1.aikido.9","2.41.5-0+deb13u1.aikido.10","2.41.5-0+deb13u1.aikido.11","2.41.5-0+deb13u1.aikido.15","2.41.5-0+deb13u1.aikido.12","2.41.5-0+deb13u1.aikido.13"],"sources":["osv"]},{"ecosystem":"Root:Debian:13","package":"rootio-util-linux","fixed_in":["2.41.5-0+deb13u1.aikido.14","2.41.5-0+deb13u1.aikido.7","2.41.5-0+deb13u1.aikido.8","2.41.5-0+deb13u1.aikido.9","2.41.5-0+deb13u1.aikido.10","2.41.5-0+deb13u1.aikido.11","2.41.5-0+deb13u1.aikido.15","2.41.5-0+deb13u1.aikido.12","2.41.5-0+deb13u1.aikido.13"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.22","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.41.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.41.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.42.3-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"libblkid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.40.2-18.el10_2.20"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:10","package":"libblkid-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.40.2-18.el10_2.20"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:10","package":"libfdisk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.40.2-18.el10_2.20"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:10","package":"libfdisk-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.40.2-18.el10_2.20"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:10","package":"libmount","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.40.2-18.el10_2.20"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:10","package":"libmount-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.40.2-18.el10_2.20"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:10","package":"libsmartcols","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.40.2-18.el10_2.20"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:10","package":"libsmartcols-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.40.2-18.el10_2.20"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:10","package":"libuuid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.40.2-18.el10_2.20"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:10","package":"libuuid-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.40.2-18.el10_2.20"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:10","package":"python3-libmount","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.40.2-18.el10_2.20"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:10","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.40.2-18.el10_2.20"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:10","package":"util-linux-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.40.2-18.el10_2.20"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:10","package":"uuidd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.40.2-18.el10_2.20"}]}],"bundled":9},{"source":"osv","ecosystem":"Azure Linux:3","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.40.2-6"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.41-r6"},{"fixed":"2.41.6-r1"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.39-r14"},{"fixed":"2.42.3-r1"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:25","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.41-r6"},{"fixed":"2.41.6-r1"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.39-r14"},{"fixed":"2.42.3-r1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.41-5","2.41.1-1","2.41.1-2","2.41.1-3","2.41.1-4","2.41.2-1","2.41.2-2","2.41.2-3","2.41.2-4","2.41.3-1","2.41.3-2","2.41.3-3","2.41.3-4","2.41.5-0+deb13u1","2.42-1","2.42-2","2.42-3","2.42-4","2.42-5","2.42-6","2.42.1-1","2.42.1-2","2.42.1-3","2.42.1-4","2.42.1-5","2.42.1-6","2.42.2-1","2.42.2-2","2.42.2-3","2.42.2-4","2.42.3-1","2.42.4-1","2.42~rc1-1","2.42~rc1-2","2.42~rc1-3","2.42~rc2-1"]},{"source":"osv","ecosystem":"Debian:14","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.42.3-1"}]}],"versions":["2.41-5","2.41.1-1","2.41.1-2","2.41.1-3","2.41.1-4","2.41.2-1","2.41.2-2","2.41.2-3","2.41.2-4","2.41.3-1","2.41.3-2","2.41.3-3","2.41.3-4","2.42-1","2.42-2","2.42-3","2.42-4","2.42-5","2.42-6","2.42.1-1","2.42.1-2","2.42.1-3","2.42.1-4","2.42.1-5","2.42.1-6","2.42.2-1","2.42.2-2","2.42.2-3","2.42.2-4","2.42~rc1-1","2.42~rc1-2","2.42~rc1-3","2.42~rc2-1"]},{"source":"osv","ecosystem":"Mageia:10","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.42.4-1.mga10"}]}],"bundled":8},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.39.1-41.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.39.1-41.oe2403sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.39.1-44.oe2403sp3"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libblkid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.42.2-3.4.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libblkid-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.42.2-3.4.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libfdisk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.42.2-3.4.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libfdisk-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.42.2-3.4.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"liblastlog2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.42.2-3.4.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"liblastlog2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.42.2-3.4.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libmount","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.42.2-3.4.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libmount-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.42.2-3.4.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libsmartcols","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.42.2-3.4.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libsmartcols-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.42.2-3.4.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libuuid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.42.2-3.4.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libuuid-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.42.2-3.4.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3-libmount","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.42.2-3.4.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.42.2-3.4.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"util-linux-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.42.2-3.4.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"util-linux-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.42.2-3.4.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"util-linux-script","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.42.2-3.4.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"uuidd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.42.2-3.4.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:10","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.40.2-18.el10_2.20"}]}],"bundled":9},{"source":"osv","ecosystem":"Root:Debian:12","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.38.1-5+deb12u3.aikido.17"},{"fixed":"2.38.1-5+deb12u3.aikido.18"},{"fixed":"2.38.1-5+deb12u3.aikido.9"},{"fixed":"2.38.1-5+deb12u3.aikido.10"},{"fixed":"2.38.1-5+deb12u3.aikido.11"},{"fixed":"2.38.1-5+deb12u3.aikido.12"},{"fixed":"2.38.1-5+deb12u3.aikido.13"},{"fixed":"2.38.1-5+deb12u3.aikido.14"},{"fixed":"2.38.1-5+deb12u3.aikido.15"},{"fixed":"2.38.1-5+deb12u3.aikido.16"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"rootio-util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.38.1-5+deb12u3.aikido.17"},{"fixed":"2.38.1-5+deb12u3.aikido.18"},{"fixed":"2.38.1-5+deb12u3.aikido.9"},{"fixed":"2.38.1-5+deb12u3.aikido.10"},{"fixed":"2.38.1-5+deb12u3.aikido.11"},{"fixed":"2.38.1-5+deb12u3.aikido.12"},{"fixed":"2.38.1-5+deb12u3.aikido.13"},{"fixed":"2.38.1-5+deb12u3.aikido.14"},{"fixed":"2.38.1-5+deb12u3.aikido.15"},{"fixed":"2.38.1-5+deb12u3.aikido.16"}]}]},{"source":"osv","ecosystem":"Root:Debian:13","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.41.5-0+deb13u1.aikido.14"},{"fixed":"2.41.5-0+deb13u1.aikido.7"},{"fixed":"2.41.5-0+deb13u1.aikido.8"},{"fixed":"2.41.5-0+deb13u1.aikido.9"},{"fixed":"2.41.5-0+deb13u1.aikido.10"},{"fixed":"2.41.5-0+deb13u1.aikido.11"},{"fixed":"2.41.5-0+deb13u1.aikido.15"},{"fixed":"2.41.5-0+deb13u1.aikido.12"},{"fixed":"2.41.5-0+deb13u1.aikido.13"}]}]},{"source":"osv","ecosystem":"Root:Debian:13","package":"rootio-util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.41.5-0+deb13u1.aikido.14"},{"fixed":"2.41.5-0+deb13u1.aikido.7"},{"fixed":"2.41.5-0+deb13u1.aikido.8"},{"fixed":"2.41.5-0+deb13u1.aikido.9"},{"fixed":"2.41.5-0+deb13u1.aikido.10"},{"fixed":"2.41.5-0+deb13u1.aikido.11"},{"fixed":"2.41.5-0+deb13u1.aikido.15"},{"fixed":"2.41.5-0+deb13u1.aikido.12"},{"fixed":"2.41.5-0+deb13u1.aikido.13"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"python-libmount","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.41.1-160000.5.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.41.1-160000.5.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"util-linux-systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.41.1-160000.5.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"python-libmount","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.41.1-160000.5.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.41.1-160000.5.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"util-linux-systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.41.1-160000.5.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"python-libmount","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.41.1-160000.5.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.41.1-160000.5.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"util-linux-systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.41.1-160000.5.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"python-libmount","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.41.1-160000.5.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.41.1-160000.5.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"util-linux-systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.41.1-160000.5.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.41.1-160000.5.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"util-linux-systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.41.1-160000.5.1"}]}],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.20.1-5.1ubuntu9","2.20.1-5.1ubuntu10","2.20.1-5.1ubuntu11","2.20.1-5.1ubuntu12","2.20.1-5.1ubuntu13","2.20.1-5.1ubuntu14","2.20.1-5.1ubuntu15","2.20.1-5.1ubuntu16","2.20.1-5.1ubuntu17","2.20.1-5.1ubuntu18","2.20.1-5.1ubuntu19","2.20.1-5.1ubuntu20","2.20.1-5.1ubuntu20.1","2.20.1-5.1ubuntu20.2","2.20.1-5.1ubuntu20.3","2.20.1-5.1ubuntu20.4","2.20.1-5.1ubuntu20.6","2.20.1-5.1ubuntu20.7","2.20.1-5.1ubuntu20.9"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.26.2-6ubuntu3","2.27-3ubuntu1","2.27.1-1ubuntu2","2.27.1-1ubuntu3","2.27.1-1ubuntu4","2.27.1-3ubuntu1","2.27.1-4ubuntu1","2.27.1-6ubuntu1","2.27.1-6ubuntu2","2.27.1-6ubuntu3","2.27.1-6ubuntu3.1","2.27.1-6ubuntu3.2","2.27.1-6ubuntu3.3","2.27.1-6ubuntu3.4","2.27.1-6ubuntu3.6","2.27.1-6ubuntu3.7","2.27.1-6ubuntu3.8","2.27.1-6ubuntu3.9","2.27.1-6ubuntu3.10","2.27.1-6ubuntu3.10+esm2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.30.1-0ubuntu4","2.30.2-0.1ubuntu1","2.30.2-0.1ubuntu2","2.30.2-0.1ubuntu3","2.31.1-0.4ubuntu2","2.31.1-0.4ubuntu3","2.31.1-0.4ubuntu3.1","2.31.1-0.4ubuntu3.2","2.31.1-0.4ubuntu3.3","2.31.1-0.4ubuntu3.4","2.31.1-0.4ubuntu3.5","2.31.1-0.4ubuntu3.6","2.31.1-0.4ubuntu3.7"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.34-0.1ubuntu2","2.34-0.1ubuntu4","2.34-0.1ubuntu5","2.34-0.1ubuntu6","2.34-0.1ubuntu7","2.34-0.1ubuntu8","2.34-0.1ubuntu9","2.34-0.1ubuntu9.1","2.34-0.1ubuntu9.3","2.34-0.1ubuntu9.4","2.34-0.1ubuntu9.5","2.34-0.1ubuntu9.6","2.34-0.1ubuntu9.6+esm1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.39.1-4ubuntu2","2.39.2-6ubuntu1","2.39.3-6ubuntu2","2.39.3-9ubuntu2","2.39.3-9ubuntu4","2.39.3-9ubuntu6","2.39.3-9ubuntu6.1","2.39.3-9ubuntu6.2","2.39.3-9ubuntu6.3","2.39.3-9ubuntu6.4","2.39.3-9ubuntu6.5","2.39.3-9ubuntu6.6"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.41.3-3ubuntu2","2.42.2-1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.41-4ubuntu4","2.41.2-4ubuntu1","2.41.2-4ubuntu2","2.41.2-4ubuntu3","2.41.3-3ubuntu1","2.41.3-3ubuntu2","2.41.3-3ubuntu2.2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.42.3-1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"python-libmount","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.41.1-160000.5.1"}]}],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.41.1-160000.5.1"}]}],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"util-linux-systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.41.1-160000.5.1"}]}],"bundled":8}],"products":[{"vendor":"util-linux","product":"util-linux"}],"references":[{"url":"https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f","tags":["vendor-advisory","exploit","advisory","article","report"]},{"url":"https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf","tags":["patch","fix"]},{"url":"https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a","tags":["patch","fix"]},{"url":"https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc","tags":["patch","fix"]},{"url":"https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476","tags":["technical-description","article"]},{"url":"https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892","tags":["technical-description","article"]},{"url":"https://github.com/util-linux/util-linux","tags":["product","package"]},{"url":"https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper","tags":["third-party-advisory","advisory"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-76642","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:93461","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-13595","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-27456","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-53612","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-53613","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-53614","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-53615","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-76642","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-78408","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-78410","tags":["report"]},{"url":"https://bugzilla.redhat.com/2454956","tags":["report"]},{"url":"https://bugzilla.redhat.com/2494101","tags":["report"]},{"url":"https://bugzilla.redhat.com/2519646","tags":["report"]},{"url":"https://bugzilla.redhat.com/2519647","tags":["report"]},{"url":"https://bugzilla.redhat.com/2519648","tags":["report"]},{"url":"https://bugzilla.redhat.com/2521999","tags":["report"]},{"url":"https://bugzilla.redhat.com/2522497","tags":["report"]},{"url":"https://bugzilla.redhat.com/2522684","tags":["report"]},{"url":"https://bugzilla.redhat.com/2552551","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-93461.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76642","tags":["web","advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-76642","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/76xxx/CVE-2026-76642.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-76642","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0560.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35435","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PG6GOWBLE22WLLWIN3COAYZZJEQKI62R/","tags":["web"]},{"url":"https://github.com/util-linux/util-linux/security/advisories/GHSA-g8wm-75wr-g2vh","tags":["advisory"]},{"url":"https://github.com/util-linux/util-linux/security/advisories/GHSA-8gj5-72r3-428g","tags":["advisory"]},{"url":"https://github.com/util-linux/util-linux/security/advisories/GHSA-67r7-8m5w-22wx","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/YOV3MY4NAWRGHXQY54MU5FVY6DSEV4CV/","tags":["web"]},{"url":"https://lists.debian.org/debian-security-announce/2026/msg00353.html","tags":["web"]},{"url":"https://ubuntu.com/security/notices/USN-8702-1","tags":["advisory"]},{"url":"https://www.openwall.com/lists/oss-security/2026/09/04/6","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/09/05/2","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3722","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3723","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3981","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53612","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53613","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53614","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78410","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:63162","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-78409","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_63162.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2521999","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-76642","tags":["advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2522497","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-78408","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78408","tags":["advisory"]},{"url":"https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2522607","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-78409","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78409","tags":["advisory"]},{"url":"https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2522684","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-78410","tags":["advisory"]},{"url":"https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m","tags":["article"]},{"url":"https://errata.rockylinux.org/RLSA-2026:93461","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2454956","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2494101","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2519646","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2519647","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2519648","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2552551","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623861-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1261606","tags":["report"]},{"url":"https://bugzilla.suse.com/1268886","tags":["report"]},{"url":"https://bugzilla.suse.com/1269583","tags":["report"]},{"url":"https://bugzilla.suse.com/1270219","tags":["report"]},{"url":"https://bugzilla.suse.com/1275441","tags":["report"]},{"url":"https://bugzilla.suse.com/1278347","tags":["report"]},{"url":"https://bugzilla.suse.com/1278348","tags":["report"]},{"url":"https://bugzilla.suse.com/1278349","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-13595","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27456","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53612","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53613","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53614","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-76642","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78408","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78410","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623870-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623884-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-76642","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78409","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-76642","title":"util-linux libmount Privilege Escalation via Failed Mount Helper","description":"util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.","status":"published","published":"2026-09-03T10:54:08.15Z","modified":"2026-09-03T14:00:29.374Z","cvss":[{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-390"],"updated_at":"2026-11-02T13:46:21.568011Z"}],"euvd":[{"id":"EUVD-2026-70382","description":"util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.","status":"published","published":"2026-09-03T10:54:08Z","modified":"2026-09-03T14:00:29Z","cvss":[{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T18:01:13.671159Z"}],"nvd":[{"id":"CVE-2026-76642","description":"util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.","status":"published","published":"2026-09-03T13:06:08.44Z","modified":"2026-09-24T20:28:01.78Z","cvss":[{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-390"],"updated_at":"2026-11-02T14:12:43.399612Z"}],"osv":[{"id":"ALPINE-CVE-2026-76642","description":"util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.","status":"published","published":"2026-09-03T13:06:08.44Z","modified":"2026-10-01T02:17:49.406823011Z","cvss":[{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:27:50.764331Z"},{"id":"BELL-CVE-2026-76642","status":"published","published":"2026-09-05T06:06:14.857464Z","modified":"2026-10-02T06:01:05.76112Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:26.041478Z"},{"id":"CVE-2026-76642","title":"util-linux libmount Privilege Escalation via Failed Mount Helper","description":"util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.","status":"published","published":"2026-09-03T10:54:08.15Z","modified":"2026-11-02T10:41:47.947954969Z","cvss":[{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-390"],"updated_at":"2026-11-02T15:45:17.102988Z"},{"id":"DEBIAN-CVE-2026-76642","description":"util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.","status":"published","published":"2026-09-03T13:06:08.44Z","modified":"2026-11-01T20:00:08.095698349Z","cvss":[{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:46:03.502256Z"},{"id":"OESA-2026-3722","title":"util-linux security update","description":"The util-linux package contains a random collection of files that implements some low-level basic linux utilities.\r\n\r\nSecurity Fix(es):\n\nutil-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.(CVE-2026-76642)","status":"published","published":"2026-09-14T16:33:44Z","modified":"2026-09-13T16:45:31.5268922Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3723","title":"util-linux security update","description":"The util-linux package contains a random collection of files that implements some low-level basic linux utilities.\r\n\r\nSecurity Fix(es):\n\nutil-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.(CVE-2026-76642)","status":"published","published":"2026-09-14T16:33:45Z","modified":"2026-09-13T16:45:30.588440837Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3981","title":"util-linux security update","description":"The util-linux package contains a random collection of files that implements some low-level basic linux utilities.\r\n\r\nSecurity Fix(es):\n\nCVE-2026-53612 has no publicly disclosed vulnerability details yet. It is only indexed by the Snyk data source. Details are pending disclosure.(CVE-2026-53612)\n\nWhen an /etc/fstab entry is configured with the user or users option, mount(8) validates the target path before performing the mount syscall, creating a Time-of-Check-Time-of-Use (TOCTOU) window. A local unprivileged user with write access to an ancestor directory of the mount target can swap that directory to redirect the mount to an arbitrary root-owned location, potentially escalating privileges to root.(CVE-2026-53613)\n\nA flaw was found in util-linux. The mount(8) SUID binary does not sanitize the LIBMOUNT_FORCE_MOUNT2 environment variable before use. A local unprivileged user can set this variable to force mount(8) to use the legacy two-step mount(2) code path, which applies security restrictions such as nosuid and noexec after the mount is already active. During this window, an attacker can execute a SUID binary from the mounted filesystem, allowing local privilege escalation to root. Affected versions: util-linux v2.39.1 through v2.43-devel (current master).(CVE-2026-53614)\n\nutil-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.(CVE-2026-76642)\n\nA flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.(CVE-2026-78410)","status":"published","published":"2026-09-20T13:23:47Z","modified":"2026-09-20T13:30:28.277154641Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"RHSA-2026:63162","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-09-04T10:13:58Z","modified":"2026-10-17T10:17:14Z","cvss":[{"version":"3.1","score":7.9,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RLSA-2026:93461","title":"Important: util-linux security update","description":"The util-linux packages contain a large variety of low-level system utilities that are necessary for a Linux system to function. Among others, these include the fdisk configuration tool and the login program.\n\nSecurity Fix(es):\n\n* util-linux: TOCTOU in the mount program when setting up loop devices (CVE-2026-27456)\n\n* util-linux: util-linux: heap use-after-free in libblkid nested partition probing (CVE-2026-13595)\n\n* util-linux: TOCTOU in the mount program via ancestor directory swap on target path (CVE-2026-53613)\n\n* util-linux: util-linux: TOCTOU in the mount program when applying post-mount ownership/mode changes (CVE-2026-53612)\n\n* util-linux: util-linux: SUID mount(8) allows nosuid/noexec bypass via LIBMOUNT_FORCE_MOUNT2 (CVE-2026-53614)\n\n* util-linux: util-linux: failed external mount helper still runs privileged X-mount post-hooks (CVE-2026-76642)\n\n* util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority (CVE-2026-78408)\n\n* util-linux: util-linux: restricted bind mounts do not pin the source, allowing X-mount.owner/group/mode redirection (CVE-2026-78410)\n\n* util-linux: util-linux: Partition metadata compromise via integer overflow in DOS partition parser (CVE-2026-53615)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-11-03T12:10:03.560067Z","modified":"2026-11-03T12:30:03.478027736Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T13:02:16.068655Z"},{"id":"UBUNTU-CVE-2026-76642","description":"util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.","status":"published","published":"2026-09-03T13:06:00Z","modified":"2026-11-09T12:52:32.245301689Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-09T13:26:05.568602Z"},{"id":"ALSA-2026:93461","title":"Important: util-linux security update","description":"The util-linux packages contain a large variety of low-level system utilities that are necessary for a Linux system to function. Among others, these include the fdisk configuration tool and the login program.  \n\nSecurity Fix(es):  \n\n  * util-linux: TOCTOU in the mount program when setting up loop devices (CVE-2026-27456)\n  * util-linux: util-linux: heap use-after-free in libblkid nested partition probing (CVE-2026-13595)\n  * util-linux: TOCTOU in the mount program via ancestor directory swap on target path (CVE-2026-53613)\n  * util-linux: util-linux: TOCTOU in the mount program when applying post-mount ownership/mode changes (CVE-2026-53612)\n  * util-linux: util-linux: SUID mount(8) allows nosuid/noexec bypass via LIBMOUNT_FORCE_MOUNT2 (CVE-2026-53614)\n  * util-linux: util-linux: failed external mount helper still runs privileged X-mount post-hooks (CVE-2026-76642)\n  * util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority (CVE-2026-78408)\n  * util-linux: util-linux: restricted bind mounts do not pin the source, allowing X-mount.owner/group/mode redirection (CVE-2026-78410)\n  * util-linux: util-linux: Partition metadata compromise via integer overflow in DOS partition parser (CVE-2026-53615)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-11-02T00:00:00Z","modified":"2026-11-02T10:30:02.100888253Z","updated_at":"2026-11-02T15:27:57.367731Z"},{"id":"AZL-99081","title":"CVE-2026-76642 affecting package util-linux for versions less than 2.40.2-6","description":"util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.","status":"published","published":"2026-09-03T13:06:08Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:26.480138Z"},{"id":"MGASA-2026-0560","title":"Updated util-linux package fixes security vulnerabilities","description":"Additional fix for CVE-2024-28085.\nLocal Privilege Escalation via TOCTOU in mount(8) hook_owner.c\nchmod/chown. (CVE-2026-53612)\nLocal Privilege Escalation via TOCTOU in mount(8) — Target Path\nRedirection. (CVE-2026-53613)\nLocal Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment\nVariable — nosuid/noexec Bypass in SUID mount(8). (CVE-2026-53614)\nmount(8) post-mount hooks execute after helper failure. (CVE-2026-76642)\nnsenter(1), unshare(1) file descriptor leak. (CVE-2026-78408)\nmount(8) X-mount.subdir symlink escape. (CVE-2026-78409)\nmount(8) TOCTOU race on source path. (CVE-2026-78410)\n","status":"published","published":"2026-10-27T20:02:56Z","modified":"2026-10-27T20:15:03.204676304Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:11870-1","title":"libblkid-devel-2.42.3-1.1 on GA media","description":"These are all security issues fixed in the libblkid-devel-2.42.3-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-23T00:00:00Z","modified":"2026-09-24T18:23:15.542670035Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:21905-1","title":"Security update for util-linux","description":"This update for util-linux fixes the following issues:\n\n- CVE-2026-13595: heap use-after-free in `libblkid` nested partition probing (bsc#1269583).\n- CVE-2026-27456: TOCTOU in the mount program when setting up loop devices (bsc#1261606).\n- CVE-2026-53612: local privilege escalation via TOCTOU in mount(8) hook_owner.c chmod/chown (bsc#1268886).\n- CVE-2026-53613: local privilege escalation via TOCTOU in mount(8) - Target Path Redirection (bsc#1268886).\n- CVE-2026-53614: local privilege escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec\n  Bypass in SUID mount(8) (bsc#1268886).\n- CVE-2026-76642: failed external mount helper triggers privileged `X-mount` post-hooks, which enables local privilege\n  escalation (bsc#1278349).\n- CVE-2026-78408: `nsenter --join-cgroup` leaks root `cgroup` migration authority, which allows for migration or\n  termination of root processes (bsc#1278348).\n- CVE-2026-78410: restricted `bind` mounts do not pin the source, which allows for `X-mount.owner`/`group`/`mode`\n  redirection (bsc#1278347).\n\nChanges for util-linux:\n\n- lib/fileutils: add ul_openat_resolve() openat2 wrapper (bsc#1275441)\n- lib/fileutils: fix RESOLVE_NO_SYMLINKS fallback value\n- lib/fileutils: fix unused parameter warnings without SYS_openat2\n- libmount: add missing fileutils.h include to hook_idmap.c\n- libmount: add mnt_open_tree() helper for safe tree opening\n- libmount: pin source path with openat2() for restricted users\n (bsc#1275441, bsc#1278347, CVE-2026-78410)\n- libmount: restrict source path canonicalization for non-root\n users (bsc#1275441, bsc#1278347, CVE-2026-78410)\n- libmount: skip post-mount hooks after failed mount helper\n (bsc#1275441, bsc#1278349, CVE-2026-76642)\n- libmount: use USE_LIBMOUNT_MOUNTFD_SUPPORT for idmap hook\n- nsenter: close cgroup.procs fd after join to prevent authority\n leak (bsc#1275441, bsc#1278348, CVE-2026-78408)\n- nsenter, unshare: add O_CLOEXEC to all open() calls (bsc#1275441,\n bsc#1278348, CVE-2026-78408)\n- wall, write: sanitize hostname in banner header (bsc#1275441)\n- Add missing function. (bsc#1275441)\n- ipcutils: Prevent using uninitialized variable (bsc#1268886)\n- BREAKING CHANGE:\n Paths must always be canonicalized for unprivileged users to\n ensure safe target resolution. X-mount.nocanonicalize is ignored\n for them.\n- INCOMAPTIBLE CHANGE (linux \u003c 6.15):\n X-mount.subdir: The safe detached subdirectory is no more\n supported for unprivileged users for safety reasons.\n- liblastlog2: Wait on busy SQLite connections (bsc#1268886).\n- libmount: Fix subvolid buffer overflow in get_btrfs_fs_root\n (bsc#1268886).\n- libblkid: Fix use-after-free in nested partition probing\n (bsc#1269583, bsc#1268886, CVE-2026-13595)\n- libmount: fix SUID bypass via LIBMOUNT_FORCE_MOUNT2 and legacy\n mount path (bsc#1268886, CVE-2026-53614, GHSA-67r7-8m5w-22wx).\n- fileutils: add ul_open_no_symlinks() needed by other patches\n (bsc#1268886).\n- libmount: add fd_target to context for TOCTOU race condition\n prevention (bsc#1268886, CVE-2026-53613, GHSA-8gj5-72r3-428g).\n- libmount: ignore X-mount.nocanonicalize for restricted users\n- libmount: use fd-based fchownat/chmod in hook_owner (bsc#1268886,\n CVE-2026-53612, GHSA-g8wm-75wr-g2vh).\n- libmount: restrict X-mount.subdir for non-root (bsc#1268886).\n- libmount: use fd_target in hook_idmap for move_mount()\n- libmount: add mount ID verification and man page TOCTOU note\n- loopdev: use openat2(RESOLVE_NO_SYMLINKS) for backing file\n (bsc#1268886#c2, bsc#1261606).\n- Ignore pam-config error that prevents update failure if common*\n pam configuration is not symlink to common-*-pc (bsc#1270219).\n","status":"published","published":"2026-09-22T07:23:43Z","modified":"2026-09-25T18:23:12.440484259Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2026-76642","title":"CVE-2026-76642 in util-linux - Patched by Root","description":"Root has patched CVE-2026-76642 in the util-linux package for Root:Debian:12. Multiple fixed versions available.","status":"published","published":"2026-10-16T09:26:03Z","modified":"2026-10-16T10:15:02.545920405Z","updated_at":"2026-11-02T15:53:32.570806Z"},{"id":"ROOT-OS-DEBIAN-13-CVE-2026-76642","title":"CVE-2026-76642 in util-linux - Patched by Root","description":"Root has patched CVE-2026-76642 in the util-linux package for Root:Debian:13. Multiple fixed versions available.","status":"published","published":"2026-10-16T09:34:01Z","modified":"2026-10-16T10:15:06.667185431Z","updated_at":"2026-11-02T15:53:33.681527Z"},{"id":"SUSE-SU-2026:23861-1","title":"Security update for util-linux","description":"This update for util-linux fixes the following issues:\n\n- CVE-2026-13595: heap use-after-free in `libblkid` nested partition probing (bsc#1269583).\n- CVE-2026-27456: TOCTOU in the mount program when setting up loop devices (bsc#1261606).\n- CVE-2026-53612: local privilege escalation via TOCTOU in mount(8) hook_owner.c chmod/chown (bsc#1268886).\n- CVE-2026-53613: local privilege escalation via TOCTOU in mount(8) - Target Path Redirection (bsc#1268886).\n- CVE-2026-53614: local privilege escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec\n  Bypass in SUID mount(8) (bsc#1268886).\n- CVE-2026-76642: failed external mount helper triggers privileged `X-mount` post-hooks, which enables local privilege\n  escalation (bsc#1278349).\n- CVE-2026-78408: `nsenter --join-cgroup` leaks root `cgroup` migration authority, which allows for migration or\n  termination of root processes (bsc#1278348).\n- CVE-2026-78410: restricted `bind` mounts do not pin the source, which allows for `X-mount.owner`/`group`/`mode`\n  redirection (bsc#1278347).\n\nChanges for util-linux:\n\n- lib/fileutils: add ul_openat_resolve() openat2 wrapper (bsc#1275441)\n- lib/fileutils: fix RESOLVE_NO_SYMLINKS fallback value\n- lib/fileutils: fix unused parameter warnings without SYS_openat2\n- libmount: add missing fileutils.h include to hook_idmap.c\n- libmount: add mnt_open_tree() helper for safe tree opening\n- libmount: pin source path with openat2() for restricted users\n (bsc#1275441, bsc#1278347, CVE-2026-78410)\n- libmount: restrict source path canonicalization for non-root\n users (bsc#1275441, bsc#1278347, CVE-2026-78410)\n- libmount: skip post-mount hooks after failed mount helper\n (bsc#1275441, bsc#1278349, CVE-2026-76642)\n- libmount: use USE_LIBMOUNT_MOUNTFD_SUPPORT for idmap hook\n- nsenter: close cgroup.procs fd after join to prevent authority\n leak (bsc#1275441, bsc#1278348, CVE-2026-78408)\n- nsenter, unshare: add O_CLOEXEC to all open() calls (bsc#1275441,\n bsc#1278348, CVE-2026-78408)\n- wall, write: sanitize hostname in banner header (bsc#1275441)\n- Add missing function. (bsc#1275441)\n- ipcutils: Prevent using uninitialized variable (bsc#1268886)\n- BREAKING CHANGE:\n Paths must always be canonicalized for unprivileged users to\n ensure safe target resolution. X-mount.nocanonicalize is ignored\n for them.\n- INCOMAPTIBLE CHANGE (linux \u003c 6.15):\n X-mount.subdir: The safe detached subdirectory is no more\n supported for unprivileged users for safety reasons.\n- liblastlog2: Wait on busy SQLite connections (bsc#1268886).\n- libmount: Fix subvolid buffer overflow in get_btrfs_fs_root\n (bsc#1268886).\n- libblkid: Fix use-after-free in nested partition probing\n (bsc#1269583, bsc#1268886, CVE-2026-13595)\n- libmount: fix SUID bypass via LIBMOUNT_FORCE_MOUNT2 and legacy\n mount path (bsc#1268886, CVE-2026-53614, GHSA-67r7-8m5w-22wx).\n- fileutils: add ul_open_no_symlinks() needed by other patches\n (bsc#1268886).\n- libmount: add fd_target to context for TOCTOU race condition\n prevention (bsc#1268886, CVE-2026-53613, GHSA-8gj5-72r3-428g).\n- libmount: ignore X-mount.nocanonicalize for restricted users\n- libmount: use fd-based fchownat/chmod in hook_owner (bsc#1268886,\n CVE-2026-53612, GHSA-g8wm-75wr-g2vh).\n- libmount: restrict X-mount.subdir for non-root (bsc#1268886).\n- libmount: use fd_target in hook_idmap for move_mount()\n- libmount: add mount ID verification and man page TOCTOU note\n- loopdev: use openat2(RESOLVE_NO_SYMLINKS) for backing file\n (bsc#1268886#c2, bsc#1261606).\n- Ignore pam-config error that prevents update failure if common*\n pam configuration is not symlink to common-*-pc (bsc#1270219).\n","status":"published","published":"2026-09-22T07:23:33Z","modified":"2026-09-27T18:23:16.546288969Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:23870-1","title":"Security update for util-linux","description":"This update for util-linux fixes the following issues:\n\n- CVE-2026-13595: heap use-after-free in `libblkid` nested partition probing (bsc#1269583).\n- CVE-2026-27456: TOCTOU in the mount program when setting up loop devices (bsc#1261606).\n- CVE-2026-53612: local privilege escalation via TOCTOU in mount(8) hook_owner.c chmod/chown (bsc#1268886).\n- CVE-2026-53613: local privilege escalation via TOCTOU in mount(8) - Target Path Redirection (bsc#1268886).\n- CVE-2026-53614: local privilege escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec\n  Bypass in SUID mount(8) (bsc#1268886).\n- CVE-2026-76642: failed external mount helper triggers privileged `X-mount` post-hooks, which enables local privilege\n  escalation (bsc#1278349).\n- CVE-2026-78408: `nsenter --join-cgroup` leaks root `cgroup` migration authority, which allows for migration or\n  termination of root processes (bsc#1278348).\n- CVE-2026-78410: restricted `bind` mounts do not pin the source, which allows for `X-mount.owner`/`group`/`mode`\n  redirection (bsc#1278347).\n\nChanges for util-linux:\n\n- lib/fileutils: add ul_openat_resolve() openat2 wrapper (bsc#1275441)\n- lib/fileutils: fix RESOLVE_NO_SYMLINKS fallback value\n- lib/fileutils: fix unused parameter warnings without SYS_openat2\n- libmount: add missing fileutils.h include to hook_idmap.c\n- libmount: add mnt_open_tree() helper for safe tree opening\n- libmount: pin source path with openat2() for restricted users\n (bsc#1275441, bsc#1278347, CVE-2026-78410)\n- libmount: restrict source path canonicalization for non-root\n users (bsc#1275441, bsc#1278347, CVE-2026-78410)\n- libmount: skip post-mount hooks after failed mount helper\n (bsc#1275441, bsc#1278349, CVE-2026-76642)\n- libmount: use USE_LIBMOUNT_MOUNTFD_SUPPORT for idmap hook\n- nsenter: close cgroup.procs fd after join to prevent authority\n leak (bsc#1275441, bsc#1278348, CVE-2026-78408)\n- nsenter, unshare: add O_CLOEXEC to all open() calls (bsc#1275441,\n bsc#1278348, CVE-2026-78408)\n- wall, write: sanitize hostname in banner header (bsc#1275441)\n- Add missing function. (bsc#1275441)\n- ipcutils: Prevent using uninitialized variable (bsc#1268886)\n- BREAKING CHANGE:\n Paths must always be canonicalized for unprivileged users to\n ensure safe target resolution. X-mount.nocanonicalize is ignored\n for them.\n- INCOMAPTIBLE CHANGE (linux \u003c 6.15):\n X-mount.subdir: The safe detached subdirectory is no more\n supported for unprivileged users for safety reasons.\n- liblastlog2: Wait on busy SQLite connections (bsc#1268886).\n- libmount: Fix subvolid buffer overflow in get_btrfs_fs_root\n (bsc#1268886).\n- libblkid: Fix use-after-free in nested partition probing\n (bsc#1269583, bsc#1268886, CVE-2026-13595)\n- libmount: fix SUID bypass via LIBMOUNT_FORCE_MOUNT2 and legacy\n mount path (bsc#1268886, CVE-2026-53614, GHSA-67r7-8m5w-22wx).\n- fileutils: add ul_open_no_symlinks() needed by other patches\n (bsc#1268886).\n- libmount: add fd_target to context for TOCTOU race condition\n prevention (bsc#1268886, CVE-2026-53613, GHSA-8gj5-72r3-428g).\n- libmount: ignore X-mount.nocanonicalize for restricted users\n- libmount: use fd-based fchownat/chmod in hook_owner (bsc#1268886,\n CVE-2026-53612, GHSA-g8wm-75wr-g2vh).\n- libmount: restrict X-mount.subdir for non-root (bsc#1268886).\n- libmount: use fd_target in hook_idmap for move_mount()\n- libmount: add mount ID verification and man page TOCTOU note\n- loopdev: use openat2(RESOLVE_NO_SYMLINKS) for backing file\n (bsc#1268886#c2, bsc#1261606).\n- Ignore pam-config error that prevents update failure if common*\n pam configuration is not symlink to common-*-pc (bsc#1270219).\n","status":"published","published":"2026-09-22T07:23:33Z","modified":"2026-09-27T18:23:17.189268803Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:23884-1","title":"Security update for util-linux","description":"This update for util-linux fixes the following issues:\n\n- CVE-2026-13595: heap use-after-free in `libblkid` nested partition probing (bsc#1269583).\n- CVE-2026-27456: TOCTOU in the mount program when setting up loop devices (bsc#1261606).\n- CVE-2026-53612: local privilege escalation via TOCTOU in mount(8) hook_owner.c chmod/chown (bsc#1268886).\n- CVE-2026-53613: local privilege escalation via TOCTOU in mount(8) - Target Path Redirection (bsc#1268886).\n- CVE-2026-53614: local privilege escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec\n  Bypass in SUID mount(8) (bsc#1268886).\n- CVE-2026-76642: failed external mount helper triggers privileged `X-mount` post-hooks, which enables local privilege\n  escalation (bsc#1278349).\n- CVE-2026-78408: `nsenter --join-cgroup` leaks root `cgroup` migration authority, which allows for migration or\n  termination of root processes (bsc#1278348).\n- CVE-2026-78410: restricted `bind` mounts do not pin the source, which allows for `X-mount.owner`/`group`/`mode`\n  redirection (bsc#1278347).\n\nChanges for util-linux:\n\n- lib/fileutils: add ul_openat_resolve() openat2 wrapper (bsc#1275441)\n- lib/fileutils: fix RESOLVE_NO_SYMLINKS fallback value\n- lib/fileutils: fix unused parameter warnings without SYS_openat2\n- libmount: add missing fileutils.h include to hook_idmap.c\n- libmount: add mnt_open_tree() helper for safe tree opening\n- libmount: pin source path with openat2() for restricted users\n (bsc#1275441, bsc#1278347, CVE-2026-78410)\n- libmount: restrict source path canonicalization for non-root\n users (bsc#1275441, bsc#1278347, CVE-2026-78410)\n- libmount: skip post-mount hooks after failed mount helper\n (bsc#1275441, bsc#1278349, CVE-2026-76642)\n- libmount: use USE_LIBMOUNT_MOUNTFD_SUPPORT for idmap hook\n- nsenter: close cgroup.procs fd after join to prevent authority\n leak (bsc#1275441, bsc#1278348, CVE-2026-78408)\n- nsenter, unshare: add O_CLOEXEC to all open() calls (bsc#1275441,\n bsc#1278348, CVE-2026-78408)\n- wall, write: sanitize hostname in banner header (bsc#1275441)\n- Add missing function. (bsc#1275441)\n- ipcutils: Prevent using uninitialized variable (bsc#1268886)\n- BREAKING CHANGE:\n Paths must always be canonicalized for unprivileged users to\n ensure safe target resolution. X-mount.nocanonicalize is ignored\n for them.\n- INCOMAPTIBLE CHANGE (linux \u003c 6.15):\n X-mount.subdir: The safe detached subdirectory is no more\n supported for unprivileged users for safety reasons.\n- liblastlog2: Wait on busy SQLite connections (bsc#1268886).\n- libmount: Fix subvolid buffer overflow in get_btrfs_fs_root\n (bsc#1268886).\n- libblkid: Fix use-after-free in nested partition probing\n (bsc#1269583, bsc#1268886, CVE-2026-13595)\n- libmount: fix SUID bypass via LIBMOUNT_FORCE_MOUNT2 and legacy\n mount path (bsc#1268886, CVE-2026-53614, GHSA-67r7-8m5w-22wx).\n- fileutils: add ul_open_no_symlinks() needed by other patches\n (bsc#1268886).\n- libmount: add fd_target to context for TOCTOU race condition\n prevention (bsc#1268886, CVE-2026-53613, GHSA-8gj5-72r3-428g).\n- libmount: ignore X-mount.nocanonicalize for restricted users\n- libmount: use fd-based fchownat/chmod in hook_owner (bsc#1268886,\n CVE-2026-53612, GHSA-g8wm-75wr-g2vh).\n- libmount: restrict X-mount.subdir for non-root (bsc#1268886).\n- libmount: use fd_target in hook_idmap for move_mount()\n- libmount: add mount ID verification and man page TOCTOU note\n- loopdev: use openat2(RESOLVE_NO_SYMLINKS) for backing file\n (bsc#1268886#c2, bsc#1261606).\n- Ignore pam-config error that prevents update failure if common*\n pam configuration is not symlink to common-*-pc (bsc#1270219).\n","status":"published","published":"2026-09-22T07:23:33Z","modified":"2026-09-30T18:23:11.186542772Z","updated_at":"2026-11-02T15:54:03.991985Z"}]}}