EUVD-2026-101123Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local shell as authorized fstab user
-
DeliveryInvoke SUID mount on permitted X-mount target
-
Exploitrenameat2(RENAME_EXCHANGE) swaps writable ancestor
-
ExecutionRedirect privileged chmod/lchown to root path
-
ImpactGain root privileges
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture TOCTOU prevention
|
| Exploitation Conditions | Requires an /etc/fstab entry that both grants the attacker mount rights via the 'user' or 'users' option AND specifies an X-mount.mode, X-mount.owner, or X-mount.group option for that entry - this non-default configuration is the core prerequisite. The attacker must also hold write access to a writable ancestor directory of the mount target so that renameat2(RENAME_EXCHANGE) can swap the path during the post-mount hook. Limiting factors: local access only (AV:L), the attacker must already be an authorized low-privileged user (PR:L), and success depends on winning a narrow timing race (AC:H), making reliable exploitation difficult. Only affects util-linux 2.39-2.41.4 and 2.42-2.42.1; hosts without such fstab entries are not exposed. |
| Impact | This is a genuine local privilege-escalation issue (root compromise) but NOT a drop-everything emergency. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N) is self-consistent with the description: exploitation requires local access by an already-authorized low-privileged user and winning a TOCTOU race (CWE-367), which accounts for the High attack complexity. Impact is High across C/I/A because success yields root. No EPSS score was provided; KEV status is not indicated (treat as not listed), and no public exploit was supplied - only vendor patch commits. The signals are therefore mutually consistent rather than conflicting: high technical impact tempered by local-only access, a non-default /etc/fstab prerequisite, and a difficult-to-win race. The real priority is moderate: patch on the normal cycle, and sooner on multi-user hosts where untrusted users have shell access and user/users fstab mounts exist. The 'Information Disclosure' tag is misleading - this is a privilege-escalation/race flaw, not information disclosure. |
| Exploit ScenarioDerived | On a multi-user Linux host, an unprivileged user permitted by an /etc/fstab line using the 'user'/'users' option together with X-mount.mode/owner/group invokes the SUID mount utility. While the post-mount hook_owner.c step runs its path-based chmod()/lchown() on the validated target, the attacker uses renameat2(RENAME_EXCHANGE) on a writable ancestor directory to swap the path so the privileged ownership/mode change lands on a root-owned file, escalating to root. No public exploit code was provided, only the fixing commits; the high attack complexity reflects the need to win the race. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Local privilege escalation in util-linux's SUID mount utility affects versions 2.39 through 2.41.4 and 2.42 through 2.42.1: a local, already-authorized low-privileged user can win a narrow timing race in the post-mount hook and redirect a privileged chmod()/lchown() onto a root-owned path, potentially obtaining root privileges. Exploitation requires a non-default /etc/fstab entry that combines the 'user' or 'users' mount option with an X-mount.mode, X-mount.owner, or X-mount.group option, plus write access to a writable ancestor directory of the mount target; the race itself is difficult (CVSS 3.1 7.0, AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor has released fixes in 2.41.5 and 2.42.2.
RemediationAI
Apply the vendor-released patch by upgrading to util-linux 2.41.5 or 2.42.2 (per the release tags referenced in the advisory), or install the corresponding backported libmount update from your distribution vendor; the fix replaces path-based lchown/chmod with descriptor-pinned fchownat(AT_EMPTY_PATH) and /proc/self/fd-based chmod, so no configuration change is needed once libmount is updated. If immediate patching is not possible, the highest-value compensating control is to remove the X-mount.mode, X-mount.owner, and X-mount.group options from any /etc/fstab entry that also carries 'user' or 'users', which entirely disables the vulnerable post-mount hook - the trade-off is that such mounts will no longer be automatically re-permissioned or re-owned at mount time, so ownership and mode must be set manually or left as provided by the mounted filesystem. As a secondary measure, audit fstab and remove the 'user'/'users' option from entries that do not genuinely need unprivileged mount rights, accepting that affected users will then require elevated privileges to mount; similarly, ensure that directories which are ancestors of mount targets for user-mountable entries are not writable by unprivileged accounts, which removes the writable-ancestor precondition for the renameat2(RENAME_EXCHANGE) race but can conflict with legitimate multi-user or automount layouts. Removing the SUID bit from /usr/bin/mount is a last-resort hardening step that blocks this and similar mount-related privilege escalations but breaks unprivileged mounting for all users on the system. Monitor the GitHub security advisory GHSA-g8wm-75wr-g2vh for any updates, and note that no public exploit code or confirmed in-the-wild exploitation has been identified at time of analysis.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a time-of-check-to-time-of-use race (CWE-367) in libmount's post-mount ownership hook, libmount/src/hook_owner.c. After the mount target has been validated, hook_post() historically applied ownership and mode changes using path-based syscalls - lchown(target, ...) and chmod(target, ...) - which re-resolve the path string at the moment of the privileged operation. Because the SUID /usr/bin/mount runs with elevated privileges, an attacker who controls a writable ancestor directory of the mount target can use renameat2() with the RENAME_EXCHANGE flag to atomically swap directory entries inside that ancestor between validation and the hook, causing the kernel to resolve 'target' to an attacker-chosen inode (for example a sensitive root-owned file) and thereby have mount chown/chmod it. The upstream fix refactors the hook to pin the target once and operate on it by file descriptor: it obtains an O_PATH | O_CLOEXEC descriptor (mnt_context_target_fd_required()/mnt_context_get_target_fd() in restricted mode, otherwise open(target, ...)), performs the ownership change with fchownat(fd, "", owner, group, AT_EMPTY_PATH), and performs the mode change through the kernel-resolved /proc/self/fd/<fd> path, which cannot be redirected by racing the original pathname. The affected configuration is specific: an fstab entry must grant unprivileged mount rights via 'user'/'users' AND request an X-mount.mode, X-mount.owner, or X-mount.group hook. Note that third-party tagging of this CVE as 'Information Disclosure' understates the assessed impact, which is a local root privilege escalation; the CVSS vector reflects high confidentiality, integrity, and availability impact with high attack complexity and low privileges required.
Know when Util Linux gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Local authorized low-priv user (AV:L/PR:L) exploiting a TOCTOU race (AC:H) with no user interaction, yielding root (C:H/I:H/A:H), scope unchanged.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
util-linux is a random collection of Linux utilities. In util-linux 2.39 through 2.41.4 and 2.42 through 2.42.1, the SUID mount utility's hook_owner.c post-mount hook performs path-based chmod() and lchown() operations on a previously validated mount target. A local low-privileged user authorized by an /etc/fstab entry with user or users and an X-mount.mode, X-mount.owner, or X-mount.group option can use renameat2(RENAME_EXCHANGE) to race a writable ancestor of the target and redirect the privileged ownership or mode change to a root-owned path, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2.
Articles & Coverage 1
Technical POC Analysis
CWE-367 (Time-of-check Time-of-use).
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
A privilege-escalation flaw in util-linux's SUID mount utility (CVE-2026-53612) can let an ordinary local user on a Linux host gain root, affecting util-linux releases 2.39 through 2.41.4 and 2.42 through 2.42.1 - the versions embedded in many server, container-host, and appliance images. The attack is only reachable on systems with a non-default /etc/fstab configuration and is hard to win reliably, so exposure is concentrated in a subset of the fleet rather than everywhere, but any single success yields full control of that host. Leadership should care because root on a production host can mean credential theft, lateral movement, and service outage, and remediation depends on tracking util-linux versions across a widely distributed estate rather than a single product owner.
Apply vendor patch (util-linux 2.41.5 and 2.42.2, or the distribution's backported equivalent). Where patching is delayed, remove or rewrite any /etc/fstab entry that pairs the 'user' or 'users' mount option with X-mount.mode, X-mount.owner, or X-mount.group, and ensure mount target paths are not located under directories writable by unprivileged users; additionally restrict interactive local access and shell availability to trusted accounts on affected hosts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
More in Util Linux
View allThe mkostemp function in login-utils in util-linux when used incorrectly allows remote attackers to cause file name coll
An integer overflow in util-linux through 2.37.1 can potentially cause a buffer overflow if an attacker were able to use
wall in util-linux through 2.40, often installed with setgid tty permissions, allows escape sequences to be sent to othe
Privilege escalation in util-linux through versions 2.41.5 and 2.42.2 allows local low-privilege users to execute privil
Blkid in util-linux before 2.26rc-1 allows local users to execute arbitrary code. Rated high severity (CVSS 7.8), this v
runuser in util-linux allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes
In util-linux before 2.32-rc1, bash-completion/umount allows local users to gain privileges by embedding shell commands
Local privilege escalation in the SUID-root mount(8) utility shipped with util-linux 2.39.1 through 2.41.4 and 2.42 thro
Local privilege escalation to root in util-linux's libmount affects versions 2.17 through 2.41.6 and 2.42 through 2.42.3
Buffer overflow in text-utils/colcrt.c in colcrt in util-linux before 2.27 allows local users to cause a denial of servi
A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. Rated medium severity (C
Unauthorized read access to root-owned files via TOCTOU race condition in util-linux mount binary (versions prior to 2.4
Exploit-DB