CVE-2026-27456
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
In util-linux prior to version 2.41.4, a TOCTOU vulnerability has been identified in the SUID binary /usr/bin/mount. When setting up loop devices, mount validates the source file path with user privileges but later re-canonicalizes and opens it with root privileges without verifying that the path has not been replaced. A local unprivileged user can replace the source file with a symlink pointing to any root-owned file or device.
Risk Assessment
An attacker can gain unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. Exploitation requires an /etc/fstab entry with user,loop options and the SUID bit set on /usr/bin/mount.
Recommendation
Immediately update util-linux to version 2.41.4. Also review /etc/fstab entries and consider removing the SUID bit from /usr/bin/mount if not required.
Other vulnerabilities in util-linux
See all- CVE-2014-9114High
Blkid in util-linux before version 2.26rc-1 allows local users to execute arbitrary code.
- CVE-2016-2779High
CVE-2016-2779 vulnerability in runuser in util-linux allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.
- CVE-2015-5224Critical
The mkostemp function in login-utils in util-linux, when used incorrectly, allows remote attackers to cause file name collision and possibly other attacks.
- CVE-2026-76642High
util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.
- CVE-2026-78410High
A flaw in util-linux: Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.
- CVE-2026-78408High
The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes.
- CVE-2026-13595Medium
A heap use-after-free vulnerability was found in the libblkid library of util-linux. During nested partition probing, a pointer to a parent partition entry becomes stale after array reallocation, allowing an attacker to read freed memory.
- CVE-2026-3184Low
A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based PAM access control rules that rely on fully qualified domain names.
- CVE-2025-14104Medium
A flaw was found in util-linux that allows a heap buffer overread when processing 256-byte usernames in the `setpwnam()` function. This affects SUID login-utils utilities that write to the password database.
Original NVD description (English source)
util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.