EUVD-2026-70382Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local attack requiring only a low-privilege account; no user interaction or scope change; full CIA impact achievable via suid-bit propagation or inode permission modification.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.
AnalysisAI
Privilege escalation in util-linux through versions 2.41.5 and 2.42.2 allows local low-privilege users to execute privileged post-mount hook operations on pre-existing filesystems by exploiting libmount's failure to validate mount helper exit status before dispatching the MOUNT_POST stage. The root cause - captured by CWE-390 - lies in context_mount.c functions mnt_context_do_mount() and mnt_context_mount(), which gate post-mount hook execution solely on a zero result code without verifying whether the underlying mount helper or kernel syscall actually succeeded. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a local account (AV:L) on a Linux system running util-linux through 2.41.5 (2.41.x branch) or through 2.42.2 (2.42.x branch). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.5 (AV:L/AC:L/AT:N/PR:L/UI:N with VC:H/VI:H/VA:H) accurately characterizes a local privilege escalation requiring only a low-privilege account and no additional complexity or user interaction. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Three upstream fix commits have been published to the util-linux repository: f57cea130839c0af8dc0525274267ae4cfd66bbf (primary fix in context_mount.c), 1d14676ea70003e9f5b2a6a76af0cadb1190411a, and a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc - all referenced in the GHSA advisory at https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, create an inventory of all systems and containers running util-linux versions 2.41.5 or 2.42.2, and document which systems permit untrusted local user access. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Util Linux
View allThe mkostemp function in login-utils in util-linux when used incorrectly allows remote attackers to cause file name coll
An integer overflow in util-linux through 2.37.1 can potentially cause a buffer overflow if an attacker were able to use
wall in util-linux through 2.40, often installed with setgid tty permissions, allows escape sequences to be sent to othe
Blkid in util-linux before 2.26rc-1 allows local users to execute arbitrary code. Rated high severity (CVSS 7.8), this v
runuser in util-linux allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes
In util-linux before 2.32-rc1, bash-completion/umount allows local users to gain privileges by embedding shell commands
Buffer overflow in text-utils/colcrt.c in colcrt in util-linux before 2.27 allows local users to cause a denial of servi
A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. Rated medium severity (C
Unauthorized read access to root-owned files via TOCTOU race condition in util-linux mount binary (versions prior to 2.4
The parse_dos_extended function in partitions/dos.c in the libblkid library in util-linux allows physically proximate at
(a) mount and (b) umount in util-linux 2.14.1, 2.17.2, and probably other versions allow local users to determine the ex
Same technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today