Vulnerability · Published Sep 3, 2026 · Assigned by VulnCheck
CVE-2026-76642util-linux libmount Privilege Escalation via Failed Mount Helper
High 7.8
In plain English
A high-severity security flaw in util-linux from util-linux. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:10 | libblkid | 2.40.2-18.el10_2.20 | ALSA-2026:93461 |
| AlmaLinux:10 | libblkid-devel | 2.40.2-18.el10_2.20 | ALSA-2026:93461 |
| AlmaLinux:10 | libfdisk | 2.40.2-18.el10_2.20 | ALSA-2026:93461 |
| AlmaLinux:10 | libfdisk-devel | 2.40.2-18.el10_2.20 | ALSA-2026:93461 |
| AlmaLinux:10 | libmount | 2.40.2-18.el10_2.20 | ALSA-2026:93461 |
| AlmaLinux:10 | libmount-devel | 2.40.2-18.el10_2.20 | ALSA-2026:93461 |
| AlmaLinux:10 | libsmartcols | 2.40.2-18.el10_2.20 | ALSA-2026:93461 |
| AlmaLinux:10 | libsmartcols-devel | 2.40.2-18.el10_2.20 | ALSA-2026:93461 |
| AlmaLinux:10 | libuuid | 2.40.2-18.el10_2.20 | ALSA-2026:93461 |
| AlmaLinux:10 | libuuid-devel | 2.40.2-18.el10_2.20 | ALSA-2026:93461 |
| AlmaLinux:10 | python3-libmount | 2.40.2-18.el10_2.20 | ALSA-2026:93461 |
| AlmaLinux:10 | util-linux | 2.40.2-18.el10_2.20 | ALSA-2026:93461 |
| AlmaLinux:10 | util-linux-core | 2.40.2-18.el10_2.20 | ALSA-2026:93461 |
| AlmaLinux:10 | uuidd | 2.40.2-18.el10_2.20 | ALSA-2026:93461 |
| Alpine:v3.22 | util-linux | 2.41.6-r0 | ALPINE-CVE-2026-76642 |
| Alpine:v3.23 | util-linux | 2.41.6-r0 | ALPINE-CVE-2026-76642 |
| Alpine:v3.24 | util-linux | 2.42.3-r0 | ALPINE-CVE-2026-76642 |
| Debian:13 | util-linux | no fix listed | DEBIAN-CVE-2026-76642 |
| Debian:14 | util-linux | 2.42.3-1 | DEBIAN-CVE-2026-76642 |
| Rocky Linux:10 | util-linux | 0:2.40.2-18.el10_2.20 | RLSA-2026:93461 |
| Ubuntu:22.04:LTS | util-linux | no fix listed | UBUNTU-CVE-2026-76642 |
| Ubuntu:24.04:LTS | util-linux | no fix listed | UBUNTU-CVE-2026-76642 |
| Ubuntu:26.04:LTS | util-linux | no fix listed | UBUNTU-CVE-2026-76642 |
| Ubuntu:26.10 | util-linux | no fix listed | UBUNTU-CVE-2026-76642 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| util-linux | util-linux | 2.39 – before 2.41.62.42 – before 2.42.3 |
Weakness: CWE-390 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- GitHub Security Advisory (GHSA-m25x-3hj9-m26f) vendor-advisory
- Patch Commit patch
- Patch Commit patch
- Patch Commit patch
- https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476 technical-description
- https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892 technical-description
- https://github.com/util-linux/util-linux product
- VulnCheck Advisory: util-linux libmount Privilege Escalation via Failed Mount Helper third-party-advisory