BusyBox CVE-2026-88838

Requires an interactive local account as a non-root user AND an /etc/fstab configured to let that user mount a device (e.g. a 'user'/'users' entry) while relying on nosuid, nodev, and/or noexec to constrain it, with BusyBox's mount applet as the active mount implementation. Limiting factors: no remote vector, the attacker must already be authenticated locally (PR:L), and systems with no user-mountable fstab entries or with BusyBox mount filtering fixed are not exploitable - this is not a default-configuration remote flaw.

This is a moderate, locally-scoped privilege/protection-mechanism issue, not an urgent remote threat. The provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, base 5.5) is internally consistent with the description: it requires local access (AV:L) by an already-authenticated low-privileged user (PR:L), is easy to perform once prerequisites exist (AC:L), and affects integrity only (I:H) because it defeats administrator-intended mount hardening (nosuid/nodev/noexec) without directly disclosing data (C:N) or denying service (A:N). No EPSS score, no CISA KEV listing, and no public exploit code were provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. No SSVC decision data was supplied. The signals are not conflicting but they ARE thin: the only sources are a Red Hat advisory and a Red Hat Bugzilla entry, both marked with no title in the input, and there is no NVD CPE/version data. Net: real but low-to-moderate priority - most dangerous as a local privilege-escalation stepping stone (bypassing noexec/nosuid enables running attacker-controlled setuid binaries) on multi-user systems that explicitly allow non-root mounts.

A local, low-privileged user on a system where /etc/fstab grants them the ability to mount a device invokes BusyBox mount with clearing-mask options on the command line. These options survive BusyBox's non-root flag filter and, once merged with the fstab options and re-parsed, clear the nosuid/nodev/noexec protections the administrator set - letting the user mount a crafted filesystem and execute setuid or device-backed payloads for local privilege escalation. No public exploit code was identified in the provided data, and exploitation requires prior local account access (AV:L/PR:L).