Log in Start free

Vulnerability · Published Oct 14, 2026 · Assigned by GitHub_M

CVE-2026-53612util-linux mount hook_owner TOCTOU allows local privilege escalation

High 7.0

In plain English

A high-severity security flaw in util-linux from util-linux. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 4% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.0High
Exploit odds (30 days)0.2%top 95.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

util-linux is a random collection of Linux utilities. In util-linux 2.39 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility's `hook_owner.c` post-mount hook performs path-based `chmod()` and `lchown()` operations on a previously validated mount target. A local low-privileged user authorized by an `/etc/fstab` entry with `user` or `users` and an `X-mount.mode`, `X-mount.owner`, or `X-mount.group` option can use `renameat2(RENAME_EXCHANGE)` to race a writable ancestor of the target and redirect the privileged ownership or mode change to a root-owned path, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:10libblkid2.40.2-18.el10_2.20ALSA-2026:93461
AlmaLinux:10libblkid-devel2.40.2-18.el10_2.20ALSA-2026:93461
AlmaLinux:10libfdisk2.40.2-18.el10_2.20ALSA-2026:93461
AlmaLinux:10libfdisk-devel2.40.2-18.el10_2.20ALSA-2026:93461
AlmaLinux:10libmount2.40.2-18.el10_2.20ALSA-2026:93461
AlmaLinux:10libmount-devel2.40.2-18.el10_2.20ALSA-2026:93461
AlmaLinux:10libsmartcols2.40.2-18.el10_2.20ALSA-2026:93461
AlmaLinux:10libsmartcols-devel2.40.2-18.el10_2.20ALSA-2026:93461
AlmaLinux:10libuuid2.40.2-18.el10_2.20ALSA-2026:93461
AlmaLinux:10libuuid-devel2.40.2-18.el10_2.20ALSA-2026:93461
AlmaLinux:10python3-libmount2.40.2-18.el10_2.20ALSA-2026:93461
AlmaLinux:10util-linux2.40.2-18.el10_2.20ALSA-2026:93461
AlmaLinux:10util-linux-core2.40.2-18.el10_2.20ALSA-2026:93461
AlmaLinux:10uuidd2.40.2-18.el10_2.20ALSA-2026:93461
Alpine:v3.22util-linux2.41.6-r0ALPINE-CVE-2026-53612
Alpine:v3.23util-linux2.41.6-r0ALPINE-CVE-2026-53612
Alpine:v3.24util-linux2.42.3-r0ALPINE-CVE-2026-53612
Debian:13util-linux2.41.5-0+deb13u1DEBIAN-CVE-2026-53612
Debian:14util-linux2.42.2-1DEBIAN-CVE-2026-53612
Rocky Linux:10util-linux0:2.40.2-18.el10_2.20RLSA-2026:93461
Ubuntu:22.04:LTSutil-linux2.37.2-4ubuntu3.6USN-8702-1
Ubuntu:24.04:LTSutil-linux2.39.3-9ubuntu6.6UBUNTU-CVE-2026-53612
Ubuntu:24.04:LTSutil-linux2.39.3-9ubuntu6.6USN-8702-1
Ubuntu:25.10util-linuxno fix listedUBUNTU-CVE-2026-53612
Ubuntu:26.04:LTSutil-linux2.41.3-3ubuntu2.2UBUNTU-CVE-2026-53612
Ubuntu:26.04:LTSutil-linux2.41.3-3ubuntu2.2USN-8702-1
Ubuntu:26.10util-linuxno fix listedUBUNTU-CVE-2026-53612

Affected products (as reported)

VendorProductVersions
util-linux util-linux >= 2.39, < 2.41.5>= 2.42, < 2.42.2

Weakness: CWE-367 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

References