util-linux mount(8) CVE-2026-78410

The attacker must have a local unprivileged account with shell access (PR:L per CVSS vector). Exploitation additionally requires an /etc/fstab entry that: (1) permits user-invocable bind mounts (user or users fstab option set), and (2) specifies a source path under a directory the attacker has write permission on, or under a writable ancestor directory of that source path - this write access is what enables the path substitution race. The highest-impact exploitation path (arbitrary root chown/chmod) further requires the fstab entry to include at least one of X-mount.owner, X-mount.group, or X-mount.mode; without these options, root does not apply ownership changes post-mount and the practical escalation impact is significantly reduced. Exploitation is not possible against default RHEL installations that lack user-mountable fstab entries with writable source paths; the vulnerability is limited to systems where administrators have explicitly configured such permissive fstab entries.

The vendor-assigned CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) is plausible for the worst-case scenario, but the AC:L rating merits scrutiny - TOCTOU races are inherently timing-dependent and many comparable vulnerabilities are classified AC:H; even a mid-sized municipal IT team in mielec managing RHEL infrastructure should treat this as a high-priority patch but can reasonably expect exploitation to require sustained local effort rather than instant one-shot execution. The C:H/I:H/A:H impact accurately reflects the ability to redirect root chown/chmod operations to any host path, which in practice enables full local privilege escalation. No EPSS score is provided and the vulnerability is not in CISA KEV, so exploitation probability and active exploitation status are unconfirmed. For OpenShift Container Platform 4 environments, the risk profile warrants closer review if container workloads can access the host mount namespace. Exploitation is conditional on a specifically permissive fstab configuration, meaningfully reducing the realistic threat surface relative to the raw CVSS score.

A local unprivileged user identifies an fstab bind-mount entry whose source path resides under a directory the user has write access to, and which includes an X-mount.owner or X-mount.mode directive. The attacker loops an atomic rename or symlink swap on the source path while repeatedly invoking the user-mountable mount, winning the TOCTOU race to redirect the bind mount to a sensitive host directory such as /etc or /root. Once the mount completes, root automatically applies the fstab-specified ownership or mode change to the attacker-controlled target directory, granting the attacker write access to a previously protected path and enabling full privilege escalation. No public proof-of-concept is identified at time of analysis.