Util Linux CVE-2026-27456

This vulnerability presents a real but constrained risk profile. The CVSS score of 4.7 reflects the limited scope (AV:L local-only, AC:H moderate complexity) and authentication requirement (PR:L), limiting the threat actor pool to existing system users. However, the impact (C:H confidentiality) is severe-unauthorized access to root-owned files, backup images, and block devices. The race condition nature (AC:H) means exploitation requires precise timing and setup: the attacker must control a directory referenced in /etc/fstab with user,loop options, have write permissions there, and execute the symlink replacement during a narrow window when mount opens the file. EPSS data not provided, but the requirement for pre-existing fstab entries and write-accessible directories significantly reduces real-world exploitability compared to the CVSS score suggests. This is not a remote or trivial-to-exploit issue, but rather a privilege escalation/disclosure path for already-authenticated users in multi-user systems with specific configuration patterns.

A local unprivileged user on a multi-user Linux system observes that /etc/fstab contains an entry such as /mnt/usb/backup.img /mnt/loop loop,user where the attacker has write permissions in /mnt/usb/. The attacker creates a symlink at /mnt/usb/backup.img pointing to /root/ssh/id_rsa (or another sensitive file), then calls mount /mnt/loop. Due to the TOCTOU race, mount validates the original file path under user privileges but subsequently opens the symlink target with root euid, allowing the attacker to read the private SSH key. Exploitation requires favorable timing and write permissions in the source directory but succeeds without elevated privileges or additional credentials. No public proof-of-concept code identified at time of analysis.