Log in Start free

Vulnerability · Published Sep 2, 2026 · Assigned by redhat

CVE-2026-78410Util-linux: util-linux: restricted bind mounts do not pin the source, allowing x-mount.owner/group/mode redirection

High 7.8

In plain English

A high-severity security flaw in Red Hat Cost Management On-Premise 1 from Red Hat. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.2%top 90.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:10libblkid2.40.2-18.el10_2.20ALSA-2026:93461
AlmaLinux:10libblkid-devel2.40.2-18.el10_2.20ALSA-2026:93461
AlmaLinux:10libfdisk2.40.2-18.el10_2.20ALSA-2026:93461
AlmaLinux:10libfdisk-devel2.40.2-18.el10_2.20ALSA-2026:93461
AlmaLinux:10libmount2.40.2-18.el10_2.20ALSA-2026:93461
AlmaLinux:10libmount-devel2.40.2-18.el10_2.20ALSA-2026:93461
AlmaLinux:10libsmartcols2.40.2-18.el10_2.20ALSA-2026:93461
AlmaLinux:10libsmartcols-devel2.40.2-18.el10_2.20ALSA-2026:93461
AlmaLinux:10libuuid2.40.2-18.el10_2.20ALSA-2026:93461
AlmaLinux:10libuuid-devel2.40.2-18.el10_2.20ALSA-2026:93461
AlmaLinux:10python3-libmount2.40.2-18.el10_2.20ALSA-2026:93461
AlmaLinux:10util-linux2.40.2-18.el10_2.20ALSA-2026:93461
AlmaLinux:10util-linux-core2.40.2-18.el10_2.20ALSA-2026:93461
AlmaLinux:10uuidd2.40.2-18.el10_2.20ALSA-2026:93461
Alpine:v3.22util-linux2.41.6-r0ALPINE-CVE-2026-78410
Alpine:v3.23util-linux2.41.6-r0ALPINE-CVE-2026-78410
Alpine:v3.24util-linux2.42.3-r0ALPINE-CVE-2026-78410
Debian:12util-linuxno fix listedDEBIAN-CVE-2026-78410
Debian:13util-linuxno fix listedDEBIAN-CVE-2026-78410
Debian:14util-linux2.42.3-1DEBIAN-CVE-2026-78410
Rocky Linux:10util-linux0:2.40.2-18.el10_2.20RLSA-2026:93461
Ubuntu:22.04:LTSutil-linuxno fix listedUBUNTU-CVE-2026-78410
Ubuntu:24.04:LTSutil-linuxno fix listedUBUNTU-CVE-2026-78410
Ubuntu:26.04:LTSutil-linuxno fix listedUBUNTU-CVE-2026-78410
Ubuntu:26.10util-linuxno fix listedUBUNTU-CVE-2026-78410

Affected products (as reported)

VendorProductVersions
Red Hat Red Hat Enterprise Linux 10 see references
Red Hat Red Hat Cost Management On-Premise 1 see references
Red Hat Red Hat Hardened Images see references
Red Hat Red Hat Enterprise Linux 7 see references
Red Hat Red Hat Enterprise Linux 8 see references
Red Hat Red Hat Enterprise Linux 9 see references
Red Hat Red Hat Enterprise Linux 9 see references
Red Hat Red Hat Enterprise Linux 9 see references
Red Hat Red Hat OpenShift Container Platform 4 see references
Red Hat Red Hat OpenShift Container Platform 4 see references
Red Hat Red Hat OpenShift Container Platform 5 see references

Weakness: CWE-367 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References