Log in Start free

Vulnerability · Published Oct 14, 2026 · Assigned by GitHub_M

CVE-2026-53614util-linux LIBMOUNT_FORCE_MOUNT2 allows nosuid and noexec bypass

High 7.0

In plain English

A high-severity privilege mismanagement in util-linux from util-linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.0High
Exploit odds (30 days)0.1%top 97.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

util-linux is a random collection of Linux utilities. In util-linux 2.39.1 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility reads the attacker-controlled `LIBMOUNT_FORCE_MOUNT2` environment variable with `getenv()`, allowing a local low-privileged user to force the non-atomic legacy bind-mount path. With an `/etc/fstab` bind mount authorized by `user` or `users` and protected by `nosuid`, `noexec`, or `nodev`, an attacker can race the window between the initial bind mount and the remount that applies those security flags and execute a SUID program from the temporarily unprotected mount, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:10libblkid2.40.2-18.el10_2.20ALSA-2026:93461
AlmaLinux:10libblkid-devel2.40.2-18.el10_2.20ALSA-2026:93461
AlmaLinux:10libfdisk2.40.2-18.el10_2.20ALSA-2026:93461
AlmaLinux:10libfdisk-devel2.40.2-18.el10_2.20ALSA-2026:93461
AlmaLinux:10libmount2.40.2-18.el10_2.20ALSA-2026:93461
AlmaLinux:10libmount-devel2.40.2-18.el10_2.20ALSA-2026:93461
AlmaLinux:10libsmartcols2.40.2-18.el10_2.20ALSA-2026:93461
AlmaLinux:10libsmartcols-devel2.40.2-18.el10_2.20ALSA-2026:93461
AlmaLinux:10libuuid2.40.2-18.el10_2.20ALSA-2026:93461
AlmaLinux:10libuuid-devel2.40.2-18.el10_2.20ALSA-2026:93461
AlmaLinux:10python3-libmount2.40.2-18.el10_2.20ALSA-2026:93461
AlmaLinux:10util-linux2.40.2-18.el10_2.20ALSA-2026:93461
AlmaLinux:10util-linux-core2.40.2-18.el10_2.20ALSA-2026:93461
AlmaLinux:10uuidd2.40.2-18.el10_2.20ALSA-2026:93461
Alpine:v3.22util-linux2.41.6-r0ALPINE-CVE-2026-53614
Alpine:v3.23util-linux2.41.6-r0ALPINE-CVE-2026-53614
Alpine:v3.24util-linux2.42.3-r0ALPINE-CVE-2026-53614
Debian:13util-linux2.41.5-0+deb13u1DEBIAN-CVE-2026-53614
Debian:14util-linux2.42.2-1DEBIAN-CVE-2026-53614
Rocky Linux:10util-linux0:2.40.2-18.el10_2.20RLSA-2026:93461
Ubuntu:22.04:LTSutil-linux2.37.2-4ubuntu3.6USN-8702-1
Ubuntu:24.04:LTSutil-linux2.39.3-9ubuntu6.6UBUNTU-CVE-2026-53614
Ubuntu:24.04:LTSutil-linux2.39.3-9ubuntu6.6USN-8702-1
Ubuntu:25.10util-linuxno fix listedUBUNTU-CVE-2026-53614
Ubuntu:26.04:LTSutil-linux2.41.3-3ubuntu2.2UBUNTU-CVE-2026-53614
Ubuntu:26.04:LTSutil-linux2.41.3-3ubuntu2.2USN-8702-1
Ubuntu:26.10util-linuxno fix listedUBUNTU-CVE-2026-53614

Affected products (as reported)

VendorProductVersions
util-linux util-linux >= 2.39.1, < 2.41.5>= 2.42, < 2.42.2

Weakness: CWE-269, CWE-807 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

References