EUVD-2026-101124Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLocal fstab-authorized user access
-
DeliveryStage attacker-writable ancestor directory
-
ExploitWin renameat2(RENAME_EXCHANGE) TOCTOU race
-
ExecutionRedirect authorized mount onto /etc/sudoers.d
-
ImpactLoad attacker sudoers, escalate to root
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture TOCTOU prevention
|
| Exploitation Conditions | Exploitation requires ALL of: (1) the attacker is a local, low-privileged user explicitly authorized to perform the mount by an |
| Impact | This is a genuine local privilege escalation to root, but with meaningful barriers that keep it below 'drop everything' priority. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0 HIGH) is internally consistent with the description: local attack vector (no remote reachability), high attack complexity reflecting the TOCTOU race window that must be won, low privileges meaning the attacker must already be a user explicitly authorized by an fstab |
| Exploit ScenarioDerived | A low-privileged local user who is authorized by an |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Local privilege escalation to root in util-linux's libmount affects versions 2.17 through 2.41.6 and 2.42 through 2.42.3, and also 2.42.4 when the legacy mount(2) path is used without /proc available. A local, low-privileged user who is already authorized by an /etc/fstab entry carrying the user or users option can exploit a time-of-check/time-of-use race: libmount validates the fstab target path and then the mount operation re-resolves that pathname, so an attacker who controls a writable ancestor directory can use renameat2(RENAME_EXCHANGE) to swap a path component and redirect the authorized mount to a root-owned location such as /etc/sudoers.d, gaining root. Exploitation is local only, requires the attacker to already hold an fstab mount authorization plus a writable ancestor on the configured target, and depends on winning the race (assessed AC:H), so it is non-deterministic; patched code paths using the new mount API (2.41.5 / 2.42.2 and later) or 2.42.4 with /proc present are not affected, and no public exploit identified at time of analysis.
RemediationAI
Vendor-released patch: upgrade util-linux to 2.42.4 (or later) with /proc mounted so legacy targets are pinned through /proc/self/fd, or to a release carrying the new-API target pinning (2.41.5 / 2.42.2 and later) if only the new mount API is in use; upstream fixes are visible in the referenced commits (for example https://github.com/util-linux/util-linux/commit/0b010025a0e429bc80355c94db86a843395d49e2) and the advisory at https://github.com/util-linux/util-linux/security/advisories/GHSA-8gj5-72r3-428g. Where patching is delayed, the highest-value compensating control is to remove the user or users option from /etc/fstab entries whose targets are not fully root-controlled, which eliminates the precondition that a non-root user is authorized to mount that path at all - the trade-off being that legitimate unprivileged mount workflows (typically removable media or user-managed loop images) will stop working for those users. Equally effective is ensuring every mount point referenced by a user/users fstab entry, and every one of its ancestor directories, is owned by root and not group- or world-writable (and avoiding targets placed under user-owned or sticky shared directories such as /tmp or a user's home), since the attack requires an attacker-writable ancestor to perform the renameat2(RENAME_EXCHANGE) swap; this may require relocating existing user mount points to a root-owned directory. Combining both measures is advisable, because the exploit depends on all prerequisites (fstab authorization, writable ancestor, vulnerable legacy path) holding simultaneously, and reliably winning the race is itself non-deterministic.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-367 time-of-check/time-of-use race in util-linux's libmount restricted-mount handling, which applies when a non-root user mounts a target permitted by an /etc/fstab entry marked user or users. Historically libmount validated the fstab target by path name and then the underlying mount operation (the new mount API or the legacy mount(2) hook) re-resolved that same pathname, leaving a window in which a component of the target path could be replaced. The upstream fix introduces a pinned target file descriptor: mnt_context_get_target_fd() opens the target with ul_open_no_symlinks(target, O_PATH | O_CLOEXEC, 0) (a RESOLVE_NO_SYMLINKS-style open) in prepare_target() whenever mnt_context_target_fd_required() reports a restricted context, and hook_attach_target() then performs move_mount() against that fd with MOVE_MOUNT_F_EMPTY_PATH | MOVE_MOUNT_T_EMPTY_PATH instead of the path string, closing the re-resolution window; mnt_context_reopen_target_fd() re-opens the fd afterwards so it refers to the mounted filesystem root. The legacy hook (hook_mount_legacy.c) re-opens the same pinned fd, and the 2.42.4 release pins legacy targets through /proc/self/fd; the documented legacy fallback that must work without /proc is the remaining exposure, which is why 2.42.4 is only affected in that specific configuration. The CPE cpe:2.3:a:util-linux:util-linux:*:*:*:*:*:*:*:* is version-agnostic, so CPE matching alone will not distinguish fixed from vulnerable builds and version-based detection is required.
Know when Util Linux gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Local-only TOCTOU race (AV:L, AC:H) exploitable by an fstab-authorized non-root user (PR:L) with no interaction, yielding full root compromise (C:H/I:H/A:H).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
DescriptionCVE.org
util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy mount(2) path is used without /proc, restricted non-root mount requests validate an /etc/fstab target before the mount operation re-resolves that pathname. A local low-privileged user authorized by an fstab user or users entry whose target has an attacker-writable ancestor can use renameat2(RENAME_EXCHANGE) to swap a path component and redirect an authorized mount to a root-owned location, such as mounting attacker-controlled content over /etc/sudoers.d, and thereby gain root privileges. Versions 2.41.5 and 2.42.2 pin targets for the new mount API, and 2.42.4 pins legacy targets through /proc/self/fd; the documented legacy fallback without /proc remains affected.
Articles & Coverage 1
Executive ViewAI
A privilege-escalation flaw in util-linux's libmount component-present by default on virtually every Linux server, container host, and workstation in the estate-allows an ordinary local user to obtain root on affected systems. The attacker must already hold a mount authorization granted through /etc/fstab plus write access to a parent directory of the configured mount target, and must win a timing race, so exploitation is opportunistic rather than trivial and is confined to hosts where untrusted users have local shell access. Leadership should care because root compromise of a Linux host undermines every downstream control-logging, segmentation, and data protection-and no vendor patch is currently available, leaving mitigation to configuration and permission hygiene.
No vendor-released patch identified at time of analysis. Interim mitigations: remove or restrict /etc/fstab entries using the user or users option; ensure all ancestor directories of mount targets are root-owned and not writable by unprivileged users; limit local interactive shell access on affected hosts; monitor for anomalous writes or renames into root-owned system paths such as /etc/sudoers.d; confirm exposure status relative to the new mount API code paths (2.41.5 / 2.42.2 and later) or 2.42.4 with /proc present.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
More in Util Linux
View allThe mkostemp function in login-utils in util-linux when used incorrectly allows remote attackers to cause file name coll
An integer overflow in util-linux through 2.37.1 can potentially cause a buffer overflow if an attacker were able to use
wall in util-linux through 2.40, often installed with setgid tty permissions, allows escape sequences to be sent to othe
Privilege escalation in util-linux through versions 2.41.5 and 2.42.2 allows local low-privilege users to execute privil
Blkid in util-linux before 2.26rc-1 allows local users to execute arbitrary code. Rated high severity (CVSS 7.8), this v
runuser in util-linux allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes
In util-linux before 2.32-rc1, bash-completion/umount allows local users to gain privileges by embedding shell commands
Local privilege escalation in the SUID-root mount(8) utility shipped with util-linux 2.39.1 through 2.41.4 and 2.42 thro
Local privilege escalation in util-linux's SUID mount utility affects versions 2.39 through 2.41.4 and 2.42 through 2.42
Buffer overflow in text-utils/colcrt.c in colcrt in util-linux before 2.27 allows local users to cause a denial of servi
A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. Rated medium severity (C
Unauthorized read access to root-owned files via TOCTOU race condition in util-linux mount binary (versions prior to 2.4
Exploit-DB