CVE-2026-53612

7.0High

Published 14 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash

7.0High

Attack vector: Local
Complexity: High
Privileges needed: Low
User interaction: None
Impact: Full C/I/A compromise
Weakness: CWE-367

Impact

A local unprivileged user can escalate to root privileges on systems with specific /etc/fstab configurations. Exploitation requires existing local shell access and an fstab entry configured with user or users alongside X-mount.mode, X-mount.owner, or X-mount.group.

Root cause

A TOCTOU race condition in the SUID mount binary allows path-based chmod and lchown operations to be redirected to arbitrary root-owned paths via renameat2.

Affected systems

util-linux 2.39 through 2.41.4, and 2.42 through 2.42.1

CVSS v3.1 · CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Fix & remediation

Upgrade util-linux to 2.41.5, 2.42.2, or newer. As an immediate mitigation, audit /etc/fstab and remove X-mount.mode, X-mount.owner, or X-mount.group options from entries configured with user or users.

shell

$ sudo apt-get update && sudo apt-get install --only-upgrade util-linux

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

util-linux is a random collection of Linux utilities. In util-linux 2.39 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility's `hook_owner.c` post-mount hook performs path-based `chmod()` and `lchown()` operations on a previously validated mount target. A local low-privileged user authorized by an `/etc/fstab` entry with `user` or `users` and an `X-mount.mode`, `X-mount.owner`, or `X-mount.group` option can use `renameat2(RENAME_EXCHANGE)` to race a writable ancestor of the target and redirect the privileged ownership or mode change to a root-owned path, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-53612