util-linux CVE-2026-53614

Exploitation requires: (1) local access with a low-privileged account (PR:L); (2) an /etc/fstab bind mount authorized for unprivileged mounting via the user or users option AND hardened with at least one of nosuid, noexec, or nodev - this specific non-default fstab configuration is the core prerequisite; and (3) the attacker-controlled LIBMOUNT_FORCE_MOUNT2 environment variable being honored by the SUID mount utility to force the legacy non-atomic bind-mount path. Limiting factors that reduce real-world risk: the attack is a timing race (AC:H) against the window between the initial bind mount and the protective remount, so it is non-deterministic and may require many attempts; it is purely local with no network vector; and hosts without the specific user/users + nosuid/noexec/nodev fstab pattern are not exploitable.

This is a genuine but conditional local privilege-escalation issue, not an internet-facing emergency. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N) confirms it requires local access, an already-authenticated low-privileged account (PR:L), and high attack complexity (AC:H) because success depends on winning a non-deterministic race between the initial bind mount and the security-flag remount. All three impact metrics are High (C:H/I:H/A:H), consistent with the stated outcome of root compromise, which is why the base score reaches 7.0 (High) despite the local vector. No EPSS score, CISA KEV listing, or public POC was provided in the intelligence, so there is no public exploit identified at time of analysis and no evidence of active exploitation - the signals are not conflicting, they are simply absent on the exploitation side. The practical priority is moderate: the flaw is real and the fix is vendor-confirmed, but exploitation is gated by a specific /etc/fstab configuration (a user/users bind mount hardened with nosuid/noexec/nodev) AND a race window, so it is far from a point-and-click escalation. Prioritize patching on multi-user/shared Linux hosts where untrusted local users exist; deprioritize on single-admin systems lacking the vulnerable fstab pattern.

A local unprivileged user on a multi-user Linux host sets the LIBMOUNT_FORCE_MOUNT2 environment variable and invokes the SUID mount utility against an /etc/fstab bind mount they are permitted to mount (user/users) that is supposed to be protected by nosuid/noexec/nodev. By forcing the legacy non-atomic mount2 path, they repeatedly race the brief window before the remount applies the protective flags and execute a prepared SUID root binary from the temporarily unprotected mount. No public exploit was provided in the intelligence, and the high attack complexity (AC:H) means the attacker must retry to win the timing race.