Skip to main content

util-linux EUVDEUVD-2026-70382

| CVE-2026-76642 HIGH
Detection of Error Condition Without Action (CWE-390)
2026-09-03 VulnCheck
Privilege Escalation Red Hat Suse Util Linux
8.5
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
8.5 HIGH
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.8 HIGH

Local attack requiring only a low-privilege account; no user interaction or scope change; full CIA impact achievable via suid-bit propagation or inode permission modification.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Red Hat
7.8 HIGH
qualitative

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

4
POC Analysis Generated
Sep 08, 2026 - 11:36 vuln.today
Source Code Evidence Fetched
Sep 03, 2026 - 11:52 vuln.today
Analysis Generated
Sep 03, 2026 - 11:52 vuln.today
CVE Published
Sep 03, 2026 - 10:54 cve.org
HIGH 8.5

DescriptionCVE.org

util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.

AnalysisAI

Privilege escalation in util-linux through versions 2.41.5 and 2.42.2 allows local low-privilege users to execute privileged post-mount hook operations on pre-existing filesystems by exploiting libmount's failure to validate mount helper exit status before dispatching the MOUNT_POST stage. The root cause - captured by CWE-390 - lies in context_mount.c functions mnt_context_do_mount() and mnt_context_mount(), which gate post-mount hook execution solely on a zero result code without verifying whether the underlying mount helper or kernel syscall actually succeeded. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Install
technique details hidden
C2
technique details hidden
Execute
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires a local account (AV:L) on a Linux system running util-linux through 2.41.5 (2.41.x branch) or through 2.42.2 (2.42.x branch). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score of 8.5 (AV:L/AC:L/AT:N/PR:L/UI:N with VC:H/VI:H/VA:H) accurately characterizes a local privilege escalation requiring only a low-privilege account and no additional complexity or user interaction. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Three upstream fix commits have been published to the util-linux repository: f57cea130839c0af8dc0525274267ae4cfd66bbf (primary fix in context_mount.c), 1d14676ea70003e9f5b2a6a76af0cadb1190411a, and a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc - all referenced in the GHSA advisory at https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, create an inventory of all systems and containers running util-linux versions 2.41.5 or 2.42.2, and document which systems permit untrusted local user access. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Util Linux

View all
CVE-2015-5224 CRITICAL
9.8 Aug 23

The mkostemp function in login-utils in util-linux when used incorrectly allows remote attackers to cause file name coll
CVE-2021-37600 MEDIUM POC
5.5 Jul 30

An integer overflow in util-linux through 2.37.1 can potentially cause a buffer overflow if an attacker were able to use
CVE-2024-28085 LOW POC
3.3 Mar 27

wall in util-linux through 2.40, often installed with setgid tty permissions, allows escape sequences to be sent to othe
CVE-2014-9114 HIGH
7.8 Mar 31

Blkid in util-linux before 2.26rc-1 allows local users to execute arbitrary code. Rated high severity (CVSS 7.8), this v
CVE-2016-2779 HIGH
7.8 Feb 07

runuser in util-linux allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes

CVE-2018-7738 HIGH
7.8 Mar 07

In util-linux before 2.32-rc1, bash-completion/umount allows local users to gain privileges by embedding shell commands

CVE-2015-5218 LOW POC
2.1 Nov 09

Buffer overflow in text-utils/colcrt.c in colcrt in util-linux before 2.27 allows local users to cause a denial of servi
CVE-2022-0563 MEDIUM
5.5 Feb 21

A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. Rated medium severity (C
CVE-2026-27456 MEDIUM
4.7 Apr 03

Unauthorized read access to root-owned files via TOCTOU race condition in util-linux mount binary (versions prior to 2.4
CVE-2016-5011 MEDIUM
4.6 Apr 11

The parse_dos_extended function in partitions/dos.c in the libblkid library in util-linux allows physically proximate at
CVE-2013-0157 LOW
2.1 Jan 21

(a) mount and (b) umount in util-linux 2.14.1, 2.17.2, and probably other versions allow local users to determine the ex

Same weakness CWE-390 – Detection of Error Condition Without Action

View all
CVE-2025-26465 MEDIUM
6.8
CVE-2021-40391 CRITICAL POC
9.8
CVE-2019-5051 HIGH POC
8.8
CVE-2024-12086 MEDIUM POC
6.8
CVE-2026-52989 CRITICAL
9.8
CVE-2024-49841 HIGH
7.8
CVE-2024-30255 HIGH
7.5
CVE-2024-27919 HIGH
7.5

Same technique Privilege Escalation

View all
CVE-2024-0012 CRITICAL POC
9.3
CVE-2025-47812 CRITICAL POC
10.0
CVE-2013-0422 CRITICAL POC
9.8
CVE-2013-0632 CRITICAL POC
9.8
CVE-2024-9474 MEDIUM POC
6.9
CVE-2017-5689 CRITICAL POC
9.8
CVE-2021-20021 CRITICAL POC
9.8
CVE-2017-12635 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SLES15-SP5-CHOST-BYOS-SAP-CCloud Affected
SLES15-SP6-CHOST-BYOS Affected
SLES15-SP6-CHOST-BYOS-Aliyun Affected
SLES15-SP6-CHOST-BYOS-Azure Affected
SLES15-SP6-CHOST-BYOS-EC2 Affected

Share

EUVD-2026-70382 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy