{"id":"USN-8091-1","aliases":[],"status":"published","title":"util-linux vulnerability","description":"It was discovered that the util-linux su utility did not drop capabilities\nwhen being used with the --pty option. While not a security issue by\nitself, a local attacker could possibly use the su tool to exploit\nvulnerabilities in other applications.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2026-03-12T19:59:51Z","modified":"2026-04-22T11:07:02Z","fixes":[{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"util-linux","fixed_in":["2.34-0.1ubuntu9.6+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"util-linux","fixed_in":["2.37.2-4ubuntu3.5"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"util-linux","fixed_in":["2.39.3-9ubuntu6.5"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"util-linux","fixed_in":["2.41-4ubuntu4.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-0.1ubuntu9.6+esm1"}]}],"versions":["2.34-0.1ubuntu2","2.34-0.1ubuntu4","2.34-0.1ubuntu5","2.34-0.1ubuntu6","2.34-0.1ubuntu7","2.34-0.1ubuntu8","2.34-0.1ubuntu9","2.34-0.1ubuntu9.1","2.34-0.1ubuntu9.3","2.34-0.1ubuntu9.4","2.34-0.1ubuntu9.5","2.34-0.1ubuntu9.6"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.37.2-4ubuntu3.5"}]}],"versions":["2.36.1-8ubuntu1","2.37.2-4ubuntu1","2.37.2-4ubuntu2","2.37.2-4ubuntu3","2.37.2-4ubuntu3.3","2.37.2-4ubuntu3.4"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.39.3-9ubuntu6.5"}]}],"versions":["2.39.1-4ubuntu2","2.39.2-6ubuntu1","2.39.3-6ubuntu2","2.39.3-9ubuntu2","2.39.3-9ubuntu4","2.39.3-9ubuntu6","2.39.3-9ubuntu6.1","2.39.3-9ubuntu6.2","2.39.3-9ubuntu6.3","2.39.3-9ubuntu6.4"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.41-4ubuntu4.2"}]}],"versions":["2.40.2-14ubuntu1","2.41-4ubuntu2","2.41-4ubuntu3","2.41-4ubuntu4","2.41-4ubuntu4.1"]}],"references":[{"url":"https://ubuntu.com/security/notices/USN-8091-1","tags":["advisory"]},{"url":"https://launchpad.net/bugs/2143850","tags":["report"]}],"sources":{"osv":[{"id":"USN-8091-1","title":"util-linux vulnerability","description":"It was discovered that the util-linux su utility did not drop capabilities\nwhen being used with the --pty option. While not a security issue by\nitself, a local attacker could possibly use the su tool to exploit\nvulnerabilities in other applications.","status":"published","published":"2026-03-12T19:59:51Z","modified":"2026-04-22T11:07:02.475047Z","updated_at":"2026-11-02T16:58:22.951676Z"}]}}