CVE-2026-88838

5.5Medium

Published 13 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash

5.5Medium

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: High impact on integrity
Weakness: CWE-693

Impact

Local unprivileged users can bypass security restrictions set in /etc/fstab to execute binaries or create device nodes. An attacker needs local user access and permission to invoke BusyBox's mount utility.

Root cause

BusyBox mount fails to filter clearing-mask options provided by non-root users, merging them as raw strings with fstab options and overriding nosuid, nodev, and noexec flags during re-parsing.

Affected systems

Versions not listed — check the vendor advisory.

CVSS v3.1 · CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Fix & remediation

Upgrade BusyBox once patched vendor packages are available. As an interim mitigation, remove user-mountable entries from /etc/fstab or drop the SUID bit from the BusyBox mount binary if present.

shell

$ chmod u-s $(which busybox)

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

A flaw was found in BusyBox's mount utility. A non-root user can bypass mount security restrictions set in /etc/fstab by specifying clearing-mask options on the command line. These options pass the non-root flag filter and are merged with fstab options as strings; when the combined options are re-parsed, clearing options can override nosuid, nodev, and noexec protections the administrator intended to enforce.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-88838