{"id":"CVE-2026-78410","aliases":["ALPINE-CVE-2026-78410","ALSA-2026:93461","AZL-99390","BELL-CVE-2026-78410","DEBIAN-CVE-2026-78410","EUVD-2026-70106","MGASA-2026-0560","OESA-2026-3978","OESA-2026-3979","OESA-2026-3980","OESA-2026-3981","OESA-2026-4073","RHSA-2026:63162","RLSA-2026:93461","ROOT-OS-DEBIAN-12-CVE-2026-78410","ROOT-OS-DEBIAN-13-CVE-2026-78410","SUSE-SU-2026:23861-1","SUSE-SU-2026:23870-1","SUSE-SU-2026:23884-1","UBUNTU-CVE-2026-78410","openSUSE-SU-2026:11870-1","openSUSE-SU-2026:21905-1"],"status":"published","title":"Util-linux: util-linux: restricted bind mounts do not pin the source, allowing x-mount.owner/group/mode redirection","description":"A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00198,"percentile":0.09736,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-367"],"published":"2026-09-02T15:05:34Z","modified":"2026-11-09T12:52:33Z","fixes":[{"ecosystem":"Alpine:v3.22","package":"util-linux","fixed_in":["2.41.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"util-linux","fixed_in":["2.41.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"util-linux","fixed_in":["2.42.3-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"util-linux","fixed_in":["2.40.2-6"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"util-linux","fixed_in":["2.38.1-r9"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"util-linux","fixed_in":["2.41.6-r1"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"util-linux","fixed_in":["2.42.3-r1"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:23","package":"util-linux","fixed_in":["2.38.1-r9"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:25","package":"util-linux","fixed_in":["2.41.6-r1"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"util-linux","fixed_in":["2.42.3-r1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"util-linux","fixed_in":["2.42.3-1"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"util-linux","fixed_in":["2.38.1-5+deb12u3.aikido.17","2.38.1-5+deb12u3.aikido.18","2.38.1-5+deb12u3.aikido.9","2.38.1-5+deb12u3.aikido.10","2.38.1-5+deb12u3.aikido.11","2.38.1-5+deb12u3.aikido.12","2.38.1-5+deb12u3.aikido.13","2.38.1-5+deb12u3.aikido.14","2.38.1-5+deb12u3.aikido.15","2.38.1-5+deb12u3.aikido.16"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"rootio-util-linux","fixed_in":["2.38.1-5+deb12u3.aikido.17","2.38.1-5+deb12u3.aikido.18","2.38.1-5+deb12u3.aikido.9","2.38.1-5+deb12u3.aikido.10","2.38.1-5+deb12u3.aikido.11","2.38.1-5+deb12u3.aikido.12","2.38.1-5+deb12u3.aikido.13","2.38.1-5+deb12u3.aikido.14","2.38.1-5+deb12u3.aikido.15","2.38.1-5+deb12u3.aikido.16"],"sources":["osv"]},{"ecosystem":"Root:Debian:13","package":"util-linux","fixed_in":["2.41.5-0+deb13u1.aikido.14","2.41.5-0+deb13u1.aikido.7","2.41.5-0+deb13u1.aikido.8","2.41.5-0+deb13u1.aikido.9","2.41.5-0+deb13u1.aikido.10","2.41.5-0+deb13u1.aikido.11","2.41.5-0+deb13u1.aikido.15","2.41.5-0+deb13u1.aikido.12","2.41.5-0+deb13u1.aikido.13"],"sources":["osv"]},{"ecosystem":"Root:Debian:13","package":"rootio-util-linux","fixed_in":["2.41.5-0+deb13u1.aikido.14","2.41.5-0+deb13u1.aikido.7","2.41.5-0+deb13u1.aikido.8","2.41.5-0+deb13u1.aikido.9","2.41.5-0+deb13u1.aikido.10","2.41.5-0+deb13u1.aikido.11","2.41.5-0+deb13u1.aikido.15","2.41.5-0+deb13u1.aikido.12","2.41.5-0+deb13u1.aikido.13"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.22","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.41.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.41.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.42.3-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"libblkid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.40.2-18.el10_2.20"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:10","package":"libblkid-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.40.2-18.el10_2.20"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:10","package":"libfdisk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.40.2-18.el10_2.20"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:10","package":"libfdisk-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.40.2-18.el10_2.20"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:10","package":"libmount","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.40.2-18.el10_2.20"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:10","package":"libmount-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.40.2-18.el10_2.20"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:10","package":"libsmartcols","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.40.2-18.el10_2.20"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:10","package":"libsmartcols-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.40.2-18.el10_2.20"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:10","package":"libuuid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.40.2-18.el10_2.20"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:10","package":"libuuid-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.40.2-18.el10_2.20"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:10","package":"python3-libmount","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.40.2-18.el10_2.20"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:10","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.40.2-18.el10_2.20"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:10","package":"util-linux-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.40.2-18.el10_2.20"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:10","package":"uuidd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.40.2-18.el10_2.20"}]}],"bundled":9},{"source":"osv","ecosystem":"Azure Linux:3","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.40.2-6"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.38.1-r2"},{"fixed":"2.38.1-r9"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.41-r6"},{"fixed":"2.41.6-r1"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.39-r14"},{"fixed":"2.42.3-r1"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:23","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.38.1-r2"},{"fixed":"2.38.1-r9"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:25","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.41-r6"},{"fixed":"2.41.6-r1"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.39-r14"},{"fixed":"2.42.3-r1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.38.1-5","2.38.1-5+deb12u1","2.38.1-5+deb12u2","2.38.1-5+deb12u3","2.38.1-5+loong64","2.38.1-6","2.39.1-1","2.39.1-2","2.39.1-3","2.39.1-4","2.39.2-1","2.39.2-2","2.39.2-2.1","2.39.2-2.2","2.39.2-3","2.39.2-4","2.39.2-5","2.39.2-6","2.39.3-1","2.39.3-10","2.39.3-11","2.39.3-2","2.39.3-3","2.39.3-4","2.39.3-5","2.39.3-6","2.39.3-6.1","2.39.3-6.1~exp1","2.39.3-7","2.39.3-8","2.39.3-9","2.40-1","2.40-2","2.40-3","2.40-4","2.40-5","2.40-6","2.40-7","2.40-8","2.40.1-1","2.40.1-2","2.40.1-3","2.40.1-4","2.40.1-4+hurd.1","2.40.1-6","2.40.1-7","2.40.1-8","2.40.1-8.1","2.40.1-9","2.40.2-1","2.40.2-10","2.40.2-11","2.40.2-12","2.40.2-12+hurd.1","2.40.2-13","2.40.2-14","2.40.2-2","2.40.2-3","2.40.2-4","2.40.2-5","2.40.2-6","2.40.2-7","2.40.2-8","2.40.2-9","2.40.3-1","2.40.4-1","2.40.4-2","2.40.4-3","2.40.4-4","2.40.4-5","2.40~rc2-1","2.40~rc2-2","2.40~rc2-3","2.40~rc2-4","2.40~rc2-5","2.40~rc2-6","2.40~rc2-7","2.40~rc2-8","2.41-1","2.41-2","2.41-3","2.41-4","2.41-5","2.41.1-1","2.41.1-2","2.41.1-3","2.41.1-4","2.41.2-1","2.41.2-2","2.41.2-3","2.41.2-4","2.41.3-1","2.41.3-2","2.41.3-3","2.41.3-4","2.41~rc1-1","2.41~rc1-2","2.41~rc2-1","2.42-1","2.42-2","2.42-3","2.42-4","2.42-5","2.42-6","2.42.1-1","2.42.1-2","2.42.1-3","2.42.1-4","2.42.1-5","2.42.1-6","2.42.2-1","2.42.2-2","2.42.2-3","2.42.2-4","2.42.3-1","2.42.4-1","2.42~rc1-1","2.42~rc1-2","2.42~rc1-3","2.42~rc2-1"]},{"source":"osv","ecosystem":"Debian:13","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.41-5","2.41.1-1","2.41.1-2","2.41.1-3","2.41.1-4","2.41.2-1","2.41.2-2","2.41.2-3","2.41.2-4","2.41.3-1","2.41.3-2","2.41.3-3","2.41.3-4","2.41.5-0+deb13u1","2.42-1","2.42-2","2.42-3","2.42-4","2.42-5","2.42-6","2.42.1-1","2.42.1-2","2.42.1-3","2.42.1-4","2.42.1-5","2.42.1-6","2.42.2-1","2.42.2-2","2.42.2-3","2.42.2-4","2.42.3-1","2.42.4-1","2.42~rc1-1","2.42~rc1-2","2.42~rc1-3","2.42~rc2-1"]},{"source":"osv","ecosystem":"Debian:14","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.42.3-1"}]}],"versions":["2.41-5","2.41.1-1","2.41.1-2","2.41.1-3","2.41.1-4","2.41.2-1","2.41.2-2","2.41.2-3","2.41.2-4","2.41.3-1","2.41.3-2","2.41.3-3","2.41.3-4","2.42-1","2.42-2","2.42-3","2.42-4","2.42-5","2.42-6","2.42.1-1","2.42.1-2","2.42.1-3","2.42.1-4","2.42.1-5","2.42.1-6","2.42.2-1","2.42.2-2","2.42.2-3","2.42.2-4","2.42~rc1-1","2.42~rc1-2","2.42~rc1-3","2.42~rc2-1"]},{"source":"osv","ecosystem":"Mageia:10","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.42.4-1.mga10"}]}],"bundled":8},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.35.2-35.oe2003sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.37.2-56.oe2203sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.39.1-44.oe2403sp1"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.39.1-44.oe2403sp3"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.39.1-44.oe2403sp4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libblkid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.42.2-3.4.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libblkid-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.42.2-3.4.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libfdisk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.42.2-3.4.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libfdisk-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.42.2-3.4.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"liblastlog2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.42.2-3.4.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"liblastlog2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.42.2-3.4.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libmount","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.42.2-3.4.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libmount-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.42.2-3.4.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libsmartcols","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.42.2-3.4.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libsmartcols-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.42.2-3.4.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libuuid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.42.2-3.4.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libuuid-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.42.2-3.4.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3-libmount","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.42.2-3.4.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.42.2-3.4.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"util-linux-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.42.2-3.4.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"util-linux-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.42.2-3.4.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"util-linux-script","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.42.2-3.4.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"uuidd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.42.2-3.4.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:10","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.40.2-18.el10_2.20"}]}],"bundled":9},{"source":"osv","ecosystem":"Root:Debian:12","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.38.1-5+deb12u3.aikido.17"},{"fixed":"2.38.1-5+deb12u3.aikido.18"},{"fixed":"2.38.1-5+deb12u3.aikido.9"},{"fixed":"2.38.1-5+deb12u3.aikido.10"},{"fixed":"2.38.1-5+deb12u3.aikido.11"},{"fixed":"2.38.1-5+deb12u3.aikido.12"},{"fixed":"2.38.1-5+deb12u3.aikido.13"},{"fixed":"2.38.1-5+deb12u3.aikido.14"},{"fixed":"2.38.1-5+deb12u3.aikido.15"},{"fixed":"2.38.1-5+deb12u3.aikido.16"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"rootio-util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.38.1-5+deb12u3.aikido.17"},{"fixed":"2.38.1-5+deb12u3.aikido.18"},{"fixed":"2.38.1-5+deb12u3.aikido.9"},{"fixed":"2.38.1-5+deb12u3.aikido.10"},{"fixed":"2.38.1-5+deb12u3.aikido.11"},{"fixed":"2.38.1-5+deb12u3.aikido.12"},{"fixed":"2.38.1-5+deb12u3.aikido.13"},{"fixed":"2.38.1-5+deb12u3.aikido.14"},{"fixed":"2.38.1-5+deb12u3.aikido.15"},{"fixed":"2.38.1-5+deb12u3.aikido.16"}]}]},{"source":"osv","ecosystem":"Root:Debian:13","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.41.5-0+deb13u1.aikido.14"},{"fixed":"2.41.5-0+deb13u1.aikido.7"},{"fixed":"2.41.5-0+deb13u1.aikido.8"},{"fixed":"2.41.5-0+deb13u1.aikido.9"},{"fixed":"2.41.5-0+deb13u1.aikido.10"},{"fixed":"2.41.5-0+deb13u1.aikido.11"},{"fixed":"2.41.5-0+deb13u1.aikido.15"},{"fixed":"2.41.5-0+deb13u1.aikido.12"},{"fixed":"2.41.5-0+deb13u1.aikido.13"}]}]},{"source":"osv","ecosystem":"Root:Debian:13","package":"rootio-util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.41.5-0+deb13u1.aikido.14"},{"fixed":"2.41.5-0+deb13u1.aikido.7"},{"fixed":"2.41.5-0+deb13u1.aikido.8"},{"fixed":"2.41.5-0+deb13u1.aikido.9"},{"fixed":"2.41.5-0+deb13u1.aikido.10"},{"fixed":"2.41.5-0+deb13u1.aikido.11"},{"fixed":"2.41.5-0+deb13u1.aikido.15"},{"fixed":"2.41.5-0+deb13u1.aikido.12"},{"fixed":"2.41.5-0+deb13u1.aikido.13"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"python-libmount","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.41.1-160000.5.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.41.1-160000.5.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"util-linux-systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.41.1-160000.5.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"python-libmount","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.41.1-160000.5.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.41.1-160000.5.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"util-linux-systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.41.1-160000.5.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"python-libmount","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.41.1-160000.5.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.41.1-160000.5.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"util-linux-systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.41.1-160000.5.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"python-libmount","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.41.1-160000.5.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.41.1-160000.5.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"util-linux-systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.41.1-160000.5.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.41.1-160000.5.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"util-linux-systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.41.1-160000.5.1"}]}],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.20.1-5.1ubuntu9","2.20.1-5.1ubuntu10","2.20.1-5.1ubuntu11","2.20.1-5.1ubuntu12","2.20.1-5.1ubuntu13","2.20.1-5.1ubuntu14","2.20.1-5.1ubuntu15","2.20.1-5.1ubuntu16","2.20.1-5.1ubuntu17","2.20.1-5.1ubuntu18","2.20.1-5.1ubuntu19","2.20.1-5.1ubuntu20","2.20.1-5.1ubuntu20.1","2.20.1-5.1ubuntu20.2","2.20.1-5.1ubuntu20.3","2.20.1-5.1ubuntu20.4","2.20.1-5.1ubuntu20.6","2.20.1-5.1ubuntu20.7","2.20.1-5.1ubuntu20.9"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.26.2-6ubuntu3","2.27-3ubuntu1","2.27.1-1ubuntu2","2.27.1-1ubuntu3","2.27.1-1ubuntu4","2.27.1-3ubuntu1","2.27.1-4ubuntu1","2.27.1-6ubuntu1","2.27.1-6ubuntu2","2.27.1-6ubuntu3","2.27.1-6ubuntu3.1","2.27.1-6ubuntu3.2","2.27.1-6ubuntu3.3","2.27.1-6ubuntu3.4","2.27.1-6ubuntu3.6","2.27.1-6ubuntu3.7","2.27.1-6ubuntu3.8","2.27.1-6ubuntu3.9","2.27.1-6ubuntu3.10","2.27.1-6ubuntu3.10+esm2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.30.1-0ubuntu4","2.30.2-0.1ubuntu1","2.30.2-0.1ubuntu2","2.30.2-0.1ubuntu3","2.31.1-0.4ubuntu2","2.31.1-0.4ubuntu3","2.31.1-0.4ubuntu3.1","2.31.1-0.4ubuntu3.2","2.31.1-0.4ubuntu3.3","2.31.1-0.4ubuntu3.4","2.31.1-0.4ubuntu3.5","2.31.1-0.4ubuntu3.6","2.31.1-0.4ubuntu3.7"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.34-0.1ubuntu2","2.34-0.1ubuntu4","2.34-0.1ubuntu5","2.34-0.1ubuntu6","2.34-0.1ubuntu7","2.34-0.1ubuntu8","2.34-0.1ubuntu9","2.34-0.1ubuntu9.1","2.34-0.1ubuntu9.3","2.34-0.1ubuntu9.4","2.34-0.1ubuntu9.5","2.34-0.1ubuntu9.6","2.34-0.1ubuntu9.6+esm1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.39.1-4ubuntu2","2.39.2-6ubuntu1","2.39.3-6ubuntu2","2.39.3-9ubuntu2","2.39.3-9ubuntu4","2.39.3-9ubuntu6","2.39.3-9ubuntu6.1","2.39.3-9ubuntu6.2","2.39.3-9ubuntu6.3","2.39.3-9ubuntu6.4","2.39.3-9ubuntu6.5","2.39.3-9ubuntu6.6"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.41.3-3ubuntu2","2.42.2-1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.41-4ubuntu4","2.41.2-4ubuntu1","2.41.2-4ubuntu2","2.41.2-4ubuntu3","2.41.3-3ubuntu1","2.41.3-3ubuntu2","2.41.3-3ubuntu2.2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.42.3-1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"python-libmount","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.41.1-160000.5.1"}]}],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.41.1-160000.5.1"}]}],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"util-linux-systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.41.1-160000.5.1"}]}],"bundled":8}],"products":[{"vendor":"red hat","product":"red hat cost management on-premise 1"},{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat hardened images"},{"vendor":"red hat","product":"red hat openshift container platform 4"},{"vendor":"red hat","product":"red hat openshift container platform 5"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:63162","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:93461","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:95365","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-78410","tags":["vdb-entry","x_refsource_REDHAT","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2522684","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m","tags":["exploit","article","report"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-78410","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-13595","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-27456","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-53612","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-53613","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-53614","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-53615","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-76642","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-78408","tags":["report"]},{"url":"https://bugzilla.redhat.com/2454956","tags":["report"]},{"url":"https://bugzilla.redhat.com/2494101","tags":["report"]},{"url":"https://bugzilla.redhat.com/2519646","tags":["report"]},{"url":"https://bugzilla.redhat.com/2519647","tags":["report"]},{"url":"https://bugzilla.redhat.com/2519648","tags":["report"]},{"url":"https://bugzilla.redhat.com/2521999","tags":["report"]},{"url":"https://bugzilla.redhat.com/2522497","tags":["report"]},{"url":"https://bugzilla.redhat.com/2522684","tags":["report"]},{"url":"https://bugzilla.redhat.com/2552551","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-93461.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78410","tags":["web","advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-78410","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-78410","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0560.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35435","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PG6GOWBLE22WLLWIN3COAYZZJEQKI62R/","tags":["web"]},{"url":"https://github.com/util-linux/util-linux/security/advisories/GHSA-g8wm-75wr-g2vh","tags":["advisory"]},{"url":"https://github.com/util-linux/util-linux/security/advisories/GHSA-8gj5-72r3-428g","tags":["advisory"]},{"url":"https://github.com/util-linux/util-linux/security/advisories/GHSA-67r7-8m5w-22wx","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/YOV3MY4NAWRGHXQY54MU5FVY6DSEV4CV/","tags":["web"]},{"url":"https://lists.debian.org/debian-security-announce/2026/msg00353.html","tags":["web"]},{"url":"https://ubuntu.com/security/notices/USN-8702-1","tags":["advisory"]},{"url":"https://www.openwall.com/lists/oss-security/2026/09/04/6","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/09/05/2","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3978","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53613","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3979","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3980","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53612","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53614","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3981","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76642","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4073","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-78409","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_63162.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2521999","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-76642","tags":["advisory"]},{"url":"https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2522497","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-78408","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78408","tags":["advisory"]},{"url":"https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2522607","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-78409","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78409","tags":["advisory"]},{"url":"https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-78410","tags":["advisory","report"]},{"url":"https://errata.rockylinux.org/RLSA-2026:93461","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2454956","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2494101","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2519646","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2519647","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2519648","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2552551","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623861-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1261606","tags":["report"]},{"url":"https://bugzilla.suse.com/1268886","tags":["report"]},{"url":"https://bugzilla.suse.com/1269583","tags":["report"]},{"url":"https://bugzilla.suse.com/1270219","tags":["report"]},{"url":"https://bugzilla.suse.com/1275441","tags":["report"]},{"url":"https://bugzilla.suse.com/1278347","tags":["report"]},{"url":"https://bugzilla.suse.com/1278348","tags":["report"]},{"url":"https://bugzilla.suse.com/1278349","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-13595","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27456","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53612","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53613","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53614","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-76642","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78408","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78410","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623870-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623884-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-78410","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78409","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-78410","title":"Util-linux: util-linux: restricted bind mounts do not pin the source, allowing x-mount.owner/group/mode redirection","description":"A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.","status":"published","published":"2026-09-02T15:05:34.414Z","modified":"2026-11-05T02:43:54.671Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-367"],"updated_at":"2026-11-05T06:56:15.67765Z"}],"euvd":[{"id":"EUVD-2026-70106","description":"A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.","status":"published","published":"2026-09-02T15:05:34Z","modified":"2026-11-05T02:43:54Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-05T06:54:34.509968Z"}],"nvd":[{"id":"CVE-2026-78410","description":"A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.","status":"published","published":"2026-09-02T16:17:23.983Z","modified":"2026-11-05T03:17:33.15Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-367"],"updated_at":"2026-11-05T06:56:39.603296Z"}],"osv":[{"id":"ALPINE-CVE-2026-78410","description":"A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.","status":"published","published":"2026-09-02T16:17:23.983Z","modified":"2026-10-01T02:17:49.411286998Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:50.764331Z"},{"id":"BELL-CVE-2026-78410","status":"published","published":"2026-09-05T06:06:15.44299Z","modified":"2026-10-06T07:15:03.729373754Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:26.041478Z"},{"id":"DEBIAN-CVE-2026-78410","description":"A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.","status":"published","published":"2026-09-02T16:17:23.983Z","modified":"2026-11-05T09:47:31.161879781Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-05T13:31:24.64316Z"},{"id":"OESA-2026-3978","title":"util-linux security update","description":"The util-linux package contains a random collection of files that implements some low-level basic linux utilities.\r\n\r\nSecurity Fix(es):\n\nWhen an /etc/fstab entry is configured with the user or users option, mount(8) validates the target path before performing the mount syscall, creating a Time-of-Check-Time-of-Use (TOCTOU) window. A local unprivileged user with write access to an ancestor directory of the mount target can swap that directory to redirect the mount to an arbitrary root-owned location, potentially escalating privileges to root.(CVE-2026-53613)\n\nA flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.(CVE-2026-78410)","status":"published","published":"2026-09-20T13:23:45Z","modified":"2026-09-20T13:30:31.209458013Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"OESA-2026-3979","title":"util-linux security update","description":"The util-linux package contains a random collection of files that implements some low-level basic linux utilities.\r\n\r\nSecurity Fix(es):\n\nWhen an /etc/fstab entry is configured with the user or users option, mount(8) validates the target path before performing the mount syscall, creating a Time-of-Check-Time-of-Use (TOCTOU) window. A local unprivileged user with write access to an ancestor directory of the mount target can swap that directory to redirect the mount to an arbitrary root-owned location, potentially escalating privileges to root.(CVE-2026-53613)\n\nA flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.(CVE-2026-78410)","status":"published","published":"2026-09-20T13:23:46Z","modified":"2026-09-20T13:30:29.71020116Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"OESA-2026-3980","title":"util-linux security update","description":"The util-linux package contains a random collection of files that implements some low-level basic linux utilities.\r\n\r\nSecurity Fix(es):\n\nCVE-2026-53612 has no publicly disclosed vulnerability details yet. It is only indexed by the Snyk data source. Details are pending disclosure.(CVE-2026-53612)\n\nWhen an /etc/fstab entry is configured with the user or users option, mount(8) validates the target path before performing the mount syscall, creating a Time-of-Check-Time-of-Use (TOCTOU) window. A local unprivileged user with write access to an ancestor directory of the mount target can swap that directory to redirect the mount to an arbitrary root-owned location, potentially escalating privileges to root.(CVE-2026-53613)\n\nA flaw was found in util-linux. The mount(8) SUID binary does not sanitize the LIBMOUNT_FORCE_MOUNT2 environment variable before use. A local unprivileged user can set this variable to force mount(8) to use the legacy two-step mount(2) code path, which applies security restrictions such as nosuid and noexec after the mount is already active. During this window, an attacker can execute a SUID binary from the mounted filesystem, allowing local privilege escalation to root. Affected versions: util-linux v2.39.1 through v2.43-devel (current master).(CVE-2026-53614)\n\nA flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.(CVE-2026-78410)","status":"published","published":"2026-09-20T13:23:47Z","modified":"2026-09-20T13:30:31.000452974Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"OESA-2026-3981","title":"util-linux security update","description":"The util-linux package contains a random collection of files that implements some low-level basic linux utilities.\r\n\r\nSecurity Fix(es):\n\nCVE-2026-53612 has no publicly disclosed vulnerability details yet. It is only indexed by the Snyk data source. Details are pending disclosure.(CVE-2026-53612)\n\nWhen an /etc/fstab entry is configured with the user or users option, mount(8) validates the target path before performing the mount syscall, creating a Time-of-Check-Time-of-Use (TOCTOU) window. A local unprivileged user with write access to an ancestor directory of the mount target can swap that directory to redirect the mount to an arbitrary root-owned location, potentially escalating privileges to root.(CVE-2026-53613)\n\nA flaw was found in util-linux. The mount(8) SUID binary does not sanitize the LIBMOUNT_FORCE_MOUNT2 environment variable before use. A local unprivileged user can set this variable to force mount(8) to use the legacy two-step mount(2) code path, which applies security restrictions such as nosuid and noexec after the mount is already active. During this window, an attacker can execute a SUID binary from the mounted filesystem, allowing local privilege escalation to root. Affected versions: util-linux v2.39.1 through v2.43-devel (current master).(CVE-2026-53614)\n\nutil-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.(CVE-2026-76642)\n\nA flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.(CVE-2026-78410)","status":"published","published":"2026-09-20T13:23:47Z","modified":"2026-09-20T13:30:28.277154641Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"OESA-2026-4073","title":"util-linux security update","description":"The util-linux package contains a random collection of files that implements some low-level basic linux utilities.\r\n\r\nSecurity Fix(es):\n\nCVE-2026-53612 has no publicly disclosed vulnerability details yet. It is only indexed by the Snyk data source. Details are pending disclosure.(CVE-2026-53612)\n\nWhen an /etc/fstab entry is configured with the user or users option, mount(8) validates the target path before performing the mount syscall, creating a Time-of-Check-Time-of-Use (TOCTOU) window. A local unprivileged user with write access to an ancestor directory of the mount target can swap that directory to redirect the mount to an arbitrary root-owned location, potentially escalating privileges to root.(CVE-2026-53613)\n\nA flaw was found in util-linux. The mount(8) SUID binary does not sanitize the LIBMOUNT_FORCE_MOUNT2 environment variable before use. A local unprivileged user can set this variable to force mount(8) to use the legacy two-step mount(2) code path, which applies security restrictions such as nosuid and noexec after the mount is already active. During this window, an attacker can execute a SUID binary from the mounted filesystem, allowing local privilege escalation to root. Affected versions: util-linux v2.39.1 through v2.43-devel (current master).(CVE-2026-53614)\n\nA flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.(CVE-2026-78410)","status":"published","published":"2026-09-25T01:28:04Z","modified":"2026-09-25T01:45:08.353737202Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"RHSA-2026:63162","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-09-04T10:13:58Z","modified":"2026-10-17T10:17:14Z","cvss":[{"version":"3.1","score":7.9,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RLSA-2026:93461","title":"Important: util-linux security update","description":"The util-linux packages contain a large variety of low-level system utilities that are necessary for a Linux system to function. Among others, these include the fdisk configuration tool and the login program.\n\nSecurity Fix(es):\n\n* util-linux: TOCTOU in the mount program when setting up loop devices (CVE-2026-27456)\n\n* util-linux: util-linux: heap use-after-free in libblkid nested partition probing (CVE-2026-13595)\n\n* util-linux: TOCTOU in the mount program via ancestor directory swap on target path (CVE-2026-53613)\n\n* util-linux: util-linux: TOCTOU in the mount program when applying post-mount ownership/mode changes (CVE-2026-53612)\n\n* util-linux: util-linux: SUID mount(8) allows nosuid/noexec bypass via LIBMOUNT_FORCE_MOUNT2 (CVE-2026-53614)\n\n* util-linux: util-linux: failed external mount helper still runs privileged X-mount post-hooks (CVE-2026-76642)\n\n* util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority (CVE-2026-78408)\n\n* util-linux: util-linux: restricted bind mounts do not pin the source, allowing X-mount.owner/group/mode redirection (CVE-2026-78410)\n\n* util-linux: util-linux: Partition metadata compromise via integer overflow in DOS partition parser (CVE-2026-53615)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-11-03T12:10:03.560067Z","modified":"2026-11-03T12:30:03.478027736Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T13:02:16.068655Z"},{"id":"UBUNTU-CVE-2026-78410","description":"A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.","status":"published","published":"2026-09-02T16:17:00Z","modified":"2026-11-09T12:52:33.441852879Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-09T13:26:05.568602Z"},{"id":"ALSA-2026:93461","title":"Important: util-linux security update","description":"The util-linux packages contain a large variety of low-level system utilities that are necessary for a Linux system to function. Among others, these include the fdisk configuration tool and the login program.  \n\nSecurity Fix(es):  \n\n  * util-linux: TOCTOU in the mount program when setting up loop devices (CVE-2026-27456)\n  * util-linux: util-linux: heap use-after-free in libblkid nested partition probing (CVE-2026-13595)\n  * util-linux: TOCTOU in the mount program via ancestor directory swap on target path (CVE-2026-53613)\n  * util-linux: util-linux: TOCTOU in the mount program when applying post-mount ownership/mode changes (CVE-2026-53612)\n  * util-linux: util-linux: SUID mount(8) allows nosuid/noexec bypass via LIBMOUNT_FORCE_MOUNT2 (CVE-2026-53614)\n  * util-linux: util-linux: failed external mount helper still runs privileged X-mount post-hooks (CVE-2026-76642)\n  * util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority (CVE-2026-78408)\n  * util-linux: util-linux: restricted bind mounts do not pin the source, allowing X-mount.owner/group/mode redirection (CVE-2026-78410)\n  * util-linux: util-linux: Partition metadata compromise via integer overflow in DOS partition parser (CVE-2026-53615)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-11-02T00:00:00Z","modified":"2026-11-02T10:30:02.100888253Z","updated_at":"2026-11-02T15:27:57.367731Z"},{"id":"AZL-99390","title":"CVE-2026-78410 affecting package util-linux for versions less than 2.40.2-6","description":"A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.","status":"published","published":"2026-09-02T16:17:23Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:26.480138Z"},{"id":"MGASA-2026-0560","title":"Updated util-linux package fixes security vulnerabilities","description":"Additional fix for CVE-2024-28085.\nLocal Privilege Escalation via TOCTOU in mount(8) hook_owner.c\nchmod/chown. (CVE-2026-53612)\nLocal Privilege Escalation via TOCTOU in mount(8) — Target Path\nRedirection. (CVE-2026-53613)\nLocal Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment\nVariable — nosuid/noexec Bypass in SUID mount(8). (CVE-2026-53614)\nmount(8) post-mount hooks execute after helper failure. (CVE-2026-76642)\nnsenter(1), unshare(1) file descriptor leak. (CVE-2026-78408)\nmount(8) X-mount.subdir symlink escape. (CVE-2026-78409)\nmount(8) TOCTOU race on source path. (CVE-2026-78410)\n","status":"published","published":"2026-10-27T20:02:56Z","modified":"2026-10-27T20:15:03.204676304Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:11870-1","title":"libblkid-devel-2.42.3-1.1 on GA media","description":"These are all security issues fixed in the libblkid-devel-2.42.3-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-23T00:00:00Z","modified":"2026-09-24T18:23:15.542670035Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:21905-1","title":"Security update for util-linux","description":"This update for util-linux fixes the following issues:\n\n- CVE-2026-13595: heap use-after-free in `libblkid` nested partition probing (bsc#1269583).\n- CVE-2026-27456: TOCTOU in the mount program when setting up loop devices (bsc#1261606).\n- CVE-2026-53612: local privilege escalation via TOCTOU in mount(8) hook_owner.c chmod/chown (bsc#1268886).\n- CVE-2026-53613: local privilege escalation via TOCTOU in mount(8) - Target Path Redirection (bsc#1268886).\n- CVE-2026-53614: local privilege escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec\n  Bypass in SUID mount(8) (bsc#1268886).\n- CVE-2026-76642: failed external mount helper triggers privileged `X-mount` post-hooks, which enables local privilege\n  escalation (bsc#1278349).\n- CVE-2026-78408: `nsenter --join-cgroup` leaks root `cgroup` migration authority, which allows for migration or\n  termination of root processes (bsc#1278348).\n- CVE-2026-78410: restricted `bind` mounts do not pin the source, which allows for `X-mount.owner`/`group`/`mode`\n  redirection (bsc#1278347).\n\nChanges for util-linux:\n\n- lib/fileutils: add ul_openat_resolve() openat2 wrapper (bsc#1275441)\n- lib/fileutils: fix RESOLVE_NO_SYMLINKS fallback value\n- lib/fileutils: fix unused parameter warnings without SYS_openat2\n- libmount: add missing fileutils.h include to hook_idmap.c\n- libmount: add mnt_open_tree() helper for safe tree opening\n- libmount: pin source path with openat2() for restricted users\n (bsc#1275441, bsc#1278347, CVE-2026-78410)\n- libmount: restrict source path canonicalization for non-root\n users (bsc#1275441, bsc#1278347, CVE-2026-78410)\n- libmount: skip post-mount hooks after failed mount helper\n (bsc#1275441, bsc#1278349, CVE-2026-76642)\n- libmount: use USE_LIBMOUNT_MOUNTFD_SUPPORT for idmap hook\n- nsenter: close cgroup.procs fd after join to prevent authority\n leak (bsc#1275441, bsc#1278348, CVE-2026-78408)\n- nsenter, unshare: add O_CLOEXEC to all open() calls (bsc#1275441,\n bsc#1278348, CVE-2026-78408)\n- wall, write: sanitize hostname in banner header (bsc#1275441)\n- Add missing function. (bsc#1275441)\n- ipcutils: Prevent using uninitialized variable (bsc#1268886)\n- BREAKING CHANGE:\n Paths must always be canonicalized for unprivileged users to\n ensure safe target resolution. X-mount.nocanonicalize is ignored\n for them.\n- INCOMAPTIBLE CHANGE (linux \u003c 6.15):\n X-mount.subdir: The safe detached subdirectory is no more\n supported for unprivileged users for safety reasons.\n- liblastlog2: Wait on busy SQLite connections (bsc#1268886).\n- libmount: Fix subvolid buffer overflow in get_btrfs_fs_root\n (bsc#1268886).\n- libblkid: Fix use-after-free in nested partition probing\n (bsc#1269583, bsc#1268886, CVE-2026-13595)\n- libmount: fix SUID bypass via LIBMOUNT_FORCE_MOUNT2 and legacy\n mount path (bsc#1268886, CVE-2026-53614, GHSA-67r7-8m5w-22wx).\n- fileutils: add ul_open_no_symlinks() needed by other patches\n (bsc#1268886).\n- libmount: add fd_target to context for TOCTOU race condition\n prevention (bsc#1268886, CVE-2026-53613, GHSA-8gj5-72r3-428g).\n- libmount: ignore X-mount.nocanonicalize for restricted users\n- libmount: use fd-based fchownat/chmod in hook_owner (bsc#1268886,\n CVE-2026-53612, GHSA-g8wm-75wr-g2vh).\n- libmount: restrict X-mount.subdir for non-root (bsc#1268886).\n- libmount: use fd_target in hook_idmap for move_mount()\n- libmount: add mount ID verification and man page TOCTOU note\n- loopdev: use openat2(RESOLVE_NO_SYMLINKS) for backing file\n (bsc#1268886#c2, bsc#1261606).\n- Ignore pam-config error that prevents update failure if common*\n pam configuration is not symlink to common-*-pc (bsc#1270219).\n","status":"published","published":"2026-09-22T07:23:43Z","modified":"2026-09-25T18:23:12.440484259Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2026-78410","title":"CVE-2026-78410 in util-linux - Patched by Root","description":"Root has patched CVE-2026-78410 in the util-linux package for Root:Debian:12. Multiple fixed versions available.","status":"published","published":"2026-10-16T09:26:03Z","modified":"2026-10-16T10:15:05.29683537Z","updated_at":"2026-11-02T15:53:32.570806Z"},{"id":"ROOT-OS-DEBIAN-13-CVE-2026-78410","title":"CVE-2026-78410 in util-linux - Patched by Root","description":"Root has patched CVE-2026-78410 in the util-linux package for Root:Debian:13. Multiple fixed versions available.","status":"published","published":"2026-10-16T09:34:01Z","modified":"2026-10-16T10:15:02.601768994Z","updated_at":"2026-11-02T15:53:33.681527Z"},{"id":"SUSE-SU-2026:23861-1","title":"Security update for util-linux","description":"This update for util-linux fixes the following issues:\n\n- CVE-2026-13595: heap use-after-free in `libblkid` nested partition probing (bsc#1269583).\n- CVE-2026-27456: TOCTOU in the mount program when setting up loop devices (bsc#1261606).\n- CVE-2026-53612: local privilege escalation via TOCTOU in mount(8) hook_owner.c chmod/chown (bsc#1268886).\n- CVE-2026-53613: local privilege escalation via TOCTOU in mount(8) - Target Path Redirection (bsc#1268886).\n- CVE-2026-53614: local privilege escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec\n  Bypass in SUID mount(8) (bsc#1268886).\n- CVE-2026-76642: failed external mount helper triggers privileged `X-mount` post-hooks, which enables local privilege\n  escalation (bsc#1278349).\n- CVE-2026-78408: `nsenter --join-cgroup` leaks root `cgroup` migration authority, which allows for migration or\n  termination of root processes (bsc#1278348).\n- CVE-2026-78410: restricted `bind` mounts do not pin the source, which allows for `X-mount.owner`/`group`/`mode`\n  redirection (bsc#1278347).\n\nChanges for util-linux:\n\n- lib/fileutils: add ul_openat_resolve() openat2 wrapper (bsc#1275441)\n- lib/fileutils: fix RESOLVE_NO_SYMLINKS fallback value\n- lib/fileutils: fix unused parameter warnings without SYS_openat2\n- libmount: add missing fileutils.h include to hook_idmap.c\n- libmount: add mnt_open_tree() helper for safe tree opening\n- libmount: pin source path with openat2() for restricted users\n (bsc#1275441, bsc#1278347, CVE-2026-78410)\n- libmount: restrict source path canonicalization for non-root\n users (bsc#1275441, bsc#1278347, CVE-2026-78410)\n- libmount: skip post-mount hooks after failed mount helper\n (bsc#1275441, bsc#1278349, CVE-2026-76642)\n- libmount: use USE_LIBMOUNT_MOUNTFD_SUPPORT for idmap hook\n- nsenter: close cgroup.procs fd after join to prevent authority\n leak (bsc#1275441, bsc#1278348, CVE-2026-78408)\n- nsenter, unshare: add O_CLOEXEC to all open() calls (bsc#1275441,\n bsc#1278348, CVE-2026-78408)\n- wall, write: sanitize hostname in banner header (bsc#1275441)\n- Add missing function. (bsc#1275441)\n- ipcutils: Prevent using uninitialized variable (bsc#1268886)\n- BREAKING CHANGE:\n Paths must always be canonicalized for unprivileged users to\n ensure safe target resolution. X-mount.nocanonicalize is ignored\n for them.\n- INCOMAPTIBLE CHANGE (linux \u003c 6.15):\n X-mount.subdir: The safe detached subdirectory is no more\n supported for unprivileged users for safety reasons.\n- liblastlog2: Wait on busy SQLite connections (bsc#1268886).\n- libmount: Fix subvolid buffer overflow in get_btrfs_fs_root\n (bsc#1268886).\n- libblkid: Fix use-after-free in nested partition probing\n (bsc#1269583, bsc#1268886, CVE-2026-13595)\n- libmount: fix SUID bypass via LIBMOUNT_FORCE_MOUNT2 and legacy\n mount path (bsc#1268886, CVE-2026-53614, GHSA-67r7-8m5w-22wx).\n- fileutils: add ul_open_no_symlinks() needed by other patches\n (bsc#1268886).\n- libmount: add fd_target to context for TOCTOU race condition\n prevention (bsc#1268886, CVE-2026-53613, GHSA-8gj5-72r3-428g).\n- libmount: ignore X-mount.nocanonicalize for restricted users\n- libmount: use fd-based fchownat/chmod in hook_owner (bsc#1268886,\n CVE-2026-53612, GHSA-g8wm-75wr-g2vh).\n- libmount: restrict X-mount.subdir for non-root (bsc#1268886).\n- libmount: use fd_target in hook_idmap for move_mount()\n- libmount: add mount ID verification and man page TOCTOU note\n- loopdev: use openat2(RESOLVE_NO_SYMLINKS) for backing file\n (bsc#1268886#c2, bsc#1261606).\n- Ignore pam-config error that prevents update failure if common*\n pam configuration is not symlink to common-*-pc (bsc#1270219).\n","status":"published","published":"2026-09-22T07:23:33Z","modified":"2026-09-27T18:23:16.546288969Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:23870-1","title":"Security update for util-linux","description":"This update for util-linux fixes the following issues:\n\n- CVE-2026-13595: heap use-after-free in `libblkid` nested partition probing (bsc#1269583).\n- CVE-2026-27456: TOCTOU in the mount program when setting up loop devices (bsc#1261606).\n- CVE-2026-53612: local privilege escalation via TOCTOU in mount(8) hook_owner.c chmod/chown (bsc#1268886).\n- CVE-2026-53613: local privilege escalation via TOCTOU in mount(8) - Target Path Redirection (bsc#1268886).\n- CVE-2026-53614: local privilege escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec\n  Bypass in SUID mount(8) (bsc#1268886).\n- CVE-2026-76642: failed external mount helper triggers privileged `X-mount` post-hooks, which enables local privilege\n  escalation (bsc#1278349).\n- CVE-2026-78408: `nsenter --join-cgroup` leaks root `cgroup` migration authority, which allows for migration or\n  termination of root processes (bsc#1278348).\n- CVE-2026-78410: restricted `bind` mounts do not pin the source, which allows for `X-mount.owner`/`group`/`mode`\n  redirection (bsc#1278347).\n\nChanges for util-linux:\n\n- lib/fileutils: add ul_openat_resolve() openat2 wrapper (bsc#1275441)\n- lib/fileutils: fix RESOLVE_NO_SYMLINKS fallback value\n- lib/fileutils: fix unused parameter warnings without SYS_openat2\n- libmount: add missing fileutils.h include to hook_idmap.c\n- libmount: add mnt_open_tree() helper for safe tree opening\n- libmount: pin source path with openat2() for restricted users\n (bsc#1275441, bsc#1278347, CVE-2026-78410)\n- libmount: restrict source path canonicalization for non-root\n users (bsc#1275441, bsc#1278347, CVE-2026-78410)\n- libmount: skip post-mount hooks after failed mount helper\n (bsc#1275441, bsc#1278349, CVE-2026-76642)\n- libmount: use USE_LIBMOUNT_MOUNTFD_SUPPORT for idmap hook\n- nsenter: close cgroup.procs fd after join to prevent authority\n leak (bsc#1275441, bsc#1278348, CVE-2026-78408)\n- nsenter, unshare: add O_CLOEXEC to all open() calls (bsc#1275441,\n bsc#1278348, CVE-2026-78408)\n- wall, write: sanitize hostname in banner header (bsc#1275441)\n- Add missing function. (bsc#1275441)\n- ipcutils: Prevent using uninitialized variable (bsc#1268886)\n- BREAKING CHANGE:\n Paths must always be canonicalized for unprivileged users to\n ensure safe target resolution. X-mount.nocanonicalize is ignored\n for them.\n- INCOMAPTIBLE CHANGE (linux \u003c 6.15):\n X-mount.subdir: The safe detached subdirectory is no more\n supported for unprivileged users for safety reasons.\n- liblastlog2: Wait on busy SQLite connections (bsc#1268886).\n- libmount: Fix subvolid buffer overflow in get_btrfs_fs_root\n (bsc#1268886).\n- libblkid: Fix use-after-free in nested partition probing\n (bsc#1269583, bsc#1268886, CVE-2026-13595)\n- libmount: fix SUID bypass via LIBMOUNT_FORCE_MOUNT2 and legacy\n mount path (bsc#1268886, CVE-2026-53614, GHSA-67r7-8m5w-22wx).\n- fileutils: add ul_open_no_symlinks() needed by other patches\n (bsc#1268886).\n- libmount: add fd_target to context for TOCTOU race condition\n prevention (bsc#1268886, CVE-2026-53613, GHSA-8gj5-72r3-428g).\n- libmount: ignore X-mount.nocanonicalize for restricted users\n- libmount: use fd-based fchownat/chmod in hook_owner (bsc#1268886,\n CVE-2026-53612, GHSA-g8wm-75wr-g2vh).\n- libmount: restrict X-mount.subdir for non-root (bsc#1268886).\n- libmount: use fd_target in hook_idmap for move_mount()\n- libmount: add mount ID verification and man page TOCTOU note\n- loopdev: use openat2(RESOLVE_NO_SYMLINKS) for backing file\n (bsc#1268886#c2, bsc#1261606).\n- Ignore pam-config error that prevents update failure if common*\n pam configuration is not symlink to common-*-pc (bsc#1270219).\n","status":"published","published":"2026-09-22T07:23:33Z","modified":"2026-09-27T18:23:17.189268803Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:23884-1","title":"Security update for util-linux","description":"This update for util-linux fixes the following issues:\n\n- CVE-2026-13595: heap use-after-free in `libblkid` nested partition probing (bsc#1269583).\n- CVE-2026-27456: TOCTOU in the mount program when setting up loop devices (bsc#1261606).\n- CVE-2026-53612: local privilege escalation via TOCTOU in mount(8) hook_owner.c chmod/chown (bsc#1268886).\n- CVE-2026-53613: local privilege escalation via TOCTOU in mount(8) - Target Path Redirection (bsc#1268886).\n- CVE-2026-53614: local privilege escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec\n  Bypass in SUID mount(8) (bsc#1268886).\n- CVE-2026-76642: failed external mount helper triggers privileged `X-mount` post-hooks, which enables local privilege\n  escalation (bsc#1278349).\n- CVE-2026-78408: `nsenter --join-cgroup` leaks root `cgroup` migration authority, which allows for migration or\n  termination of root processes (bsc#1278348).\n- CVE-2026-78410: restricted `bind` mounts do not pin the source, which allows for `X-mount.owner`/`group`/`mode`\n  redirection (bsc#1278347).\n\nChanges for util-linux:\n\n- lib/fileutils: add ul_openat_resolve() openat2 wrapper (bsc#1275441)\n- lib/fileutils: fix RESOLVE_NO_SYMLINKS fallback value\n- lib/fileutils: fix unused parameter warnings without SYS_openat2\n- libmount: add missing fileutils.h include to hook_idmap.c\n- libmount: add mnt_open_tree() helper for safe tree opening\n- libmount: pin source path with openat2() for restricted users\n (bsc#1275441, bsc#1278347, CVE-2026-78410)\n- libmount: restrict source path canonicalization for non-root\n users (bsc#1275441, bsc#1278347, CVE-2026-78410)\n- libmount: skip post-mount hooks after failed mount helper\n (bsc#1275441, bsc#1278349, CVE-2026-76642)\n- libmount: use USE_LIBMOUNT_MOUNTFD_SUPPORT for idmap hook\n- nsenter: close cgroup.procs fd after join to prevent authority\n leak (bsc#1275441, bsc#1278348, CVE-2026-78408)\n- nsenter, unshare: add O_CLOEXEC to all open() calls (bsc#1275441,\n bsc#1278348, CVE-2026-78408)\n- wall, write: sanitize hostname in banner header (bsc#1275441)\n- Add missing function. (bsc#1275441)\n- ipcutils: Prevent using uninitialized variable (bsc#1268886)\n- BREAKING CHANGE:\n Paths must always be canonicalized for unprivileged users to\n ensure safe target resolution. X-mount.nocanonicalize is ignored\n for them.\n- INCOMAPTIBLE CHANGE (linux \u003c 6.15):\n X-mount.subdir: The safe detached subdirectory is no more\n supported for unprivileged users for safety reasons.\n- liblastlog2: Wait on busy SQLite connections (bsc#1268886).\n- libmount: Fix subvolid buffer overflow in get_btrfs_fs_root\n (bsc#1268886).\n- libblkid: Fix use-after-free in nested partition probing\n (bsc#1269583, bsc#1268886, CVE-2026-13595)\n- libmount: fix SUID bypass via LIBMOUNT_FORCE_MOUNT2 and legacy\n mount path (bsc#1268886, CVE-2026-53614, GHSA-67r7-8m5w-22wx).\n- fileutils: add ul_open_no_symlinks() needed by other patches\n (bsc#1268886).\n- libmount: add fd_target to context for TOCTOU race condition\n prevention (bsc#1268886, CVE-2026-53613, GHSA-8gj5-72r3-428g).\n- libmount: ignore X-mount.nocanonicalize for restricted users\n- libmount: use fd-based fchownat/chmod in hook_owner (bsc#1268886,\n CVE-2026-53612, GHSA-g8wm-75wr-g2vh).\n- libmount: restrict X-mount.subdir for non-root (bsc#1268886).\n- libmount: use fd_target in hook_idmap for move_mount()\n- libmount: add mount ID verification and man page TOCTOU note\n- loopdev: use openat2(RESOLVE_NO_SYMLINKS) for backing file\n (bsc#1268886#c2, bsc#1261606).\n- Ignore pam-config error that prevents update failure if common*\n pam configuration is not symlink to common-*-pc (bsc#1270219).\n","status":"published","published":"2026-09-22T07:23:33Z","modified":"2026-09-30T18:23:11.186542772Z","updated_at":"2026-11-02T15:54:03.991985Z"}]}}