CVE-2026-13595

Blkid in util-linux before version 2.26rc-1 allows local users to execute arbitrary code.

CVE-2016-2779 vulnerability in runuser in util-linux allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.

The mkostemp function in login-utils in util-linux, when used incorrectly, allows remote attackers to cause file name collision and possibly other attacks.

Before util-linux 2.41.4, `parse_dos_extended()` in `libblkid/src/partitions/dos.c` computes an extended-partition start sector with 32-bit addition and does not apply the extended-area bounds checks to the first two EBR entries. A local attacker who causes a crafted DOS extended-partition disk image or removable medium to be probed can wrap `cur_start + start` to sector zero and cause libblkid to report a false partition overlapping the MBR.

In util-linux 2.39.1 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility reads the attacker-controlled `LIBMOUNT_FORCE_MOUNT2` environment variable with `getenv()`, allowing a local low-privileged user to force the non-atomic legacy bind-mount path. With an `/etc/fstab` bind mount authorized by `user` or `users` and protected by `nosuid`, `noexec`, or `nodev`, an attacker can race the window between the initial bind mount and the remount that applies those security flags and execute a SUID program from the temporarily unprotected mount, potentially gaining root privileges.

Vulnerability in util-linux versions 2.17 through 2.41.6, 2.42 through 2.42.3, and 2.42.4 when the legacy mount(2) path is used without /proc. Restricted non-root mount requests validate an /etc/fstab target before the mount operation re-resolves that pathname. A local low-privileged user authorized by an fstab user or users entry can use renameat2(RENAME_EXCHANGE) to swap a path component and redirect an authorized mount to a root-owned location, such as mounting attacker-controlled content over /etc/sudoers.d, thereby gaining root privileges.

Vulnerability in util-linux versions 2.39 through 2.41.4 and 2.42 through 2.42.1. The SUID mount utility's hook_owner.c post-mount hook performs path-based chmod() and lchown() operations on a previously validated mount target. A local low-privileged user authorized by an /etc/fstab entry with user or users and an X-mount.mode, X-mount.owner, or X-mount.group option can use renameat2(RENAME_EXCHANGE) to race a writable ancestor of the target and redirect the privileged ownership or mode change to a root-owned path, potentially gaining root privileges.

util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.

A flaw in util-linux: Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.

The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes.