Summary
The util-linux packages contain a large variety of low-level system utilities that are necessary for a Linux system to function. Among others, these include the fdisk configuration tool and the login program.
Security Fix(es):
* util-linux: TOCTOU in the mount program when setting up loop devices (CVE-2026-27456)
* util-linux: util-linux: heap use-after-free in libblkid nested partition probing (CVE-2026-13595)
* util-linux: TOCTOU in the mount program via ancestor directory swap on target path (CVE-2026-53613)
* util-linux: util-linux: TOCTOU in the mount program when applying post-mount ownership/mode changes (CVE-2026-53612)
* util-linux: util-linux: SUID mount(8) allows nosuid/noexec bypass via LIBMOUNT_FORCE_MOUNT2 (CVE-2026-53614)
* util-linux: util-linux: failed external mount helper still runs privileged X-mount post-hooks (CVE-2026-76642)
* util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority (CVE-2026-78408)
* util-linux: util-linux: restricted bind mounts do not pin the source, allowing X-mount.owner/group/mode redirection (CVE-2026-78410)
* util-linux: util-linux: Partition metadata compromise via integer overflow in DOS partition parser (CVE-2026-53615)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 14
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 10 | libblkid | 2.40.2-18.el10_2.20 |
| AlmaLinux · 10 | libblkid-devel | 2.40.2-18.el10_2.20 |
| AlmaLinux · 10 | libfdisk | 2.40.2-18.el10_2.20 |
| AlmaLinux · 10 | libfdisk-devel | 2.40.2-18.el10_2.20 |
| AlmaLinux · 10 | libmount | 2.40.2-18.el10_2.20 |
| AlmaLinux · 10 | libmount-devel | 2.40.2-18.el10_2.20 |
| AlmaLinux · 10 | libsmartcols | 2.40.2-18.el10_2.20 |
| AlmaLinux · 10 | libsmartcols-devel | 2.40.2-18.el10_2.20 |
| AlmaLinux · 10 | libuuid | 2.40.2-18.el10_2.20 |
| AlmaLinux · 10 | libuuid-devel | 2.40.2-18.el10_2.20 |
| AlmaLinux · 10 | python3-libmount | 2.40.2-18.el10_2.20 |
| AlmaLinux · 10 | util-linux | 2.40.2-18.el10_2.20 |
| AlmaLinux · 10 | util-linux-core | 2.40.2-18.el10_2.20 |
| AlmaLinux · 10 | uuidd | 2.40.2-18.el10_2.20 |
Vulnerabilities 9
-
High 8.0
util-linux libblkid DOS extended-partition overflow produces invalid partition metadata
util-linux is a random collection of Linux utilities. Before util-linux 2.41.4, `parse_dos_extended()` in `libblkid/src/partitions/dos.c` computes an extended-partition start sector with 32-bit addition and does not apply the extended-area bounds checks to th…
-
High 7.9
Util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority
The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from th…
-
High 7.8
util-linux libmount Privilege Escalation via Failed Mount Helper
util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owne…
-
High 7.8
Util-linux: util-linux: restricted bind mounts do not pin the source, allowing x-mount.owner/group/mode redirection
A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to…
-
High 7.0
util-linux mount hook_owner TOCTOU allows local privilege escalation
util-linux is a random collection of Linux utilities. In util-linux 2.39 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility's `hook_owner.c` post-mount hook performs path-based `chmod()` and `lchown()` operations on a previously validated mount …
-
High 7.0CVE-2026-53613 Public exploit
util-linux mount target TOCTOU allows local privilege escalation
util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy `mount(2)` path is used without `/proc`, restricted non-root `mount` requests validate an `/etc/fstab` target before…
-
High 7.0
util-linux LIBMOUNT_FORCE_MOUNT2 allows nosuid and noexec bypass
util-linux is a random collection of Linux utilities. In util-linux 2.39.1 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility reads the attacker-controlled `LIBMOUNT_FORCE_MOUNT2` environment variable with `getenv()`, allowing a local low-privil…
-
Medium 6.8
Util-linux: util-linux: heap use-after-free in libblkid nested partition probing
A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition ad…
-
Medium 4.7
util-linux: TOCTOU Race Condition in util-linux mount(8) - Loop Device Setup
util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates …
References
-
report
https://access.redhat.com/security/cve/CVE-2026-13595
-
report
https://access.redhat.com/security/cve/CVE-2026-27456
-
report
https://access.redhat.com/security/cve/CVE-2026-53612
-
report
https://access.redhat.com/security/cve/CVE-2026-53613
-
report
https://access.redhat.com/security/cve/CVE-2026-53614
-
report
https://access.redhat.com/security/cve/CVE-2026-53615
-
report
https://access.redhat.com/security/cve/CVE-2026-76642
-
report
https://access.redhat.com/security/cve/CVE-2026-78408
-
report
https://access.redhat.com/security/cve/CVE-2026-78410
-
report
https://bugzilla.redhat.com/2454956
-
report
https://bugzilla.redhat.com/2494101
-
report
https://bugzilla.redhat.com/2519646
-
report
https://bugzilla.redhat.com/2519647
-
report
https://bugzilla.redhat.com/2519648
-
report
https://bugzilla.redhat.com/2521999
-
report
https://bugzilla.redhat.com/2522497
-
report
https://bugzilla.redhat.com/2522684
-
report
https://bugzilla.redhat.com/2552551
-
advisory
https://errata.almalinux.org/10/ALSA-2026-93461.html