Log in Start free

Vulnerability · Published Oct 14, 2026 · Assigned by GitHub_M

CVE-2026-53613util-linux mount target TOCTOU allows local privilege escalation

High 7.0

In plain English

A high-severity security flaw in util-linux from util-linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.0High
Exploit odds (30 days)0.2%top 94.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC

Official description

util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy `mount(2)` path is used without `/proc`, restricted non-root `mount` requests validate an `/etc/fstab` target before the mount operation re-resolves that pathname. A local low-privileged user authorized by an fstab `user` or `users` entry whose target has an attacker-writable ancestor can use `renameat2(RENAME_EXCHANGE)` to swap a path component and redirect an authorized mount to a root-owned location, such as mounting attacker-controlled content over `/etc/sudoers.d`, and thereby gain root privileges. Versions 2.41.5 and 2.42.2 pin targets for the new mount API, and 2.42.4 pins legacy targets through `/proc/self/fd`; the documented legacy fallback without `/proc` remains affected.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:10libblkid2.40.2-18.el10_2.20ALSA-2026:93461
AlmaLinux:10libblkid-devel2.40.2-18.el10_2.20ALSA-2026:93461
AlmaLinux:10libfdisk2.40.2-18.el10_2.20ALSA-2026:93461
AlmaLinux:10libfdisk-devel2.40.2-18.el10_2.20ALSA-2026:93461
AlmaLinux:10libmount2.40.2-18.el10_2.20ALSA-2026:93461
AlmaLinux:10libmount-devel2.40.2-18.el10_2.20ALSA-2026:93461
AlmaLinux:10libsmartcols2.40.2-18.el10_2.20ALSA-2026:93461
AlmaLinux:10libsmartcols-devel2.40.2-18.el10_2.20ALSA-2026:93461
AlmaLinux:10libuuid2.40.2-18.el10_2.20ALSA-2026:93461
AlmaLinux:10libuuid-devel2.40.2-18.el10_2.20ALSA-2026:93461
AlmaLinux:10python3-libmount2.40.2-18.el10_2.20ALSA-2026:93461
AlmaLinux:10util-linux2.40.2-18.el10_2.20ALSA-2026:93461
AlmaLinux:10util-linux-core2.40.2-18.el10_2.20ALSA-2026:93461
AlmaLinux:10uuidd2.40.2-18.el10_2.20ALSA-2026:93461
Alpine:v3.22util-linux2.41.6-r0ALPINE-CVE-2026-53613
Alpine:v3.23util-linux2.41.6-r0ALPINE-CVE-2026-53613
Alpine:v3.24util-linux2.42.3-r0ALPINE-CVE-2026-53613
Debian:12util-linuxno fix listedDEBIAN-CVE-2026-53613
Debian:13util-linux2.41.5-0+deb13u1DEBIAN-CVE-2026-53613
Debian:14util-linux2.42.2-1DEBIAN-CVE-2026-53613
Rocky Linux:10util-linux0:2.40.2-18.el10_2.20RLSA-2026:93461
Ubuntu:22.04:LTSutil-linux2.37.2-4ubuntu3.6USN-8702-1
Ubuntu:22.04:LTSutil-linux2.37.2-4ubuntu3.6UBUNTU-CVE-2026-53613
Ubuntu:24.04:LTSutil-linux2.39.3-9ubuntu6.6UBUNTU-CVE-2026-53613
Ubuntu:24.04:LTSutil-linux2.39.3-9ubuntu6.6USN-8702-1
Ubuntu:25.10util-linuxno fix listedUBUNTU-CVE-2026-53613
Ubuntu:26.04:LTSutil-linux2.41.3-3ubuntu2.2UBUNTU-CVE-2026-53613
Ubuntu:26.04:LTSutil-linux2.41.3-3ubuntu2.2USN-8702-1
Ubuntu:26.10util-linuxno fix listedUBUNTU-CVE-2026-53613

Affected products (as reported)

VendorProductVersions
util-linux util-linux >= 2.17, <= 2.41.6>= 2.42, <= 2.42.4

Weakness: CWE-367 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

References