Summary
[2.40.2-18.0.1.el10_2.20]
- fix -d -t output regression [OLDIS-51984]
[2.40.2-20]
- libblkid: validate EBR data [CVE-2026-53615]
[2.40.2-19]
- libmount and blkid security fixes
- libblkid: fix use-after-free in nested partition probing [CVE-2026-13595]
- nsenter: close cgroup.procs fd after join to prevent authority leak
[CVE-2026-78408]
- libmount: fix SUID bypass via LIBMOUNT_FORCE_MOUNT2 and legacy mount
[CVE-2026-53614]
- libmount: TOCTOU in the mount program via ancestor directory swap on
target path [CVE-2026-53613]
- libmount: TOCTOU in the mount program when applying post-mount
ownership/mode changes [CVE-2026-53612]
- libmount: restrict the mount source for non-root users [CVE-2026-78410]
- libmount: skip post-mount hooks after a failed mount helper
[CVE-2026-76642]
- loopdev: do not follow symlinks for the backing file [CVE-2026-27456]
Fixed packages 14
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 10 | libblkid | 0:2.40.2-18.0.1.el10_2.20 |
| Oracle Linux · 10 | libblkid-devel | 0:2.40.2-18.0.1.el10_2.20 |
| Oracle Linux · 10 | libfdisk | 0:2.40.2-18.0.1.el10_2.20 |
| Oracle Linux · 10 | libfdisk-devel | 0:2.40.2-18.0.1.el10_2.20 |
| Oracle Linux · 10 | libmount | 0:2.40.2-18.0.1.el10_2.20 |
| Oracle Linux · 10 | libmount-devel | 0:2.40.2-18.0.1.el10_2.20 |
| Oracle Linux · 10 | libsmartcols | 0:2.40.2-18.0.1.el10_2.20 |
| Oracle Linux · 10 | libsmartcols-devel | 0:2.40.2-18.0.1.el10_2.20 |
| Oracle Linux · 10 | libuuid | 0:2.40.2-18.0.1.el10_2.20 |
| Oracle Linux · 10 | libuuid-devel | 0:2.40.2-18.0.1.el10_2.20 |
| Oracle Linux · 10 | python3-libmount | 0:2.40.2-18.0.1.el10_2.20 |
| Oracle Linux · 10 | util-linux | 0:2.40.2-18.0.1.el10_2.20 |
| Oracle Linux · 10 | util-linux-core | 0:2.40.2-18.0.1.el10_2.20 |
| Oracle Linux · 10 | uuidd | 0:2.40.2-18.0.1.el10_2.20 |
Vulnerabilities 9
-
High 8.0
util-linux libblkid DOS extended-partition overflow produces invalid partition metadata
util-linux is a random collection of Linux utilities. Before util-linux 2.41.4, `parse_dos_extended()` in `libblkid/src/partitions/dos.c` computes an extended-partition start sector with 32-bit addition and does not apply the extended-area bounds checks to th…
-
High 7.9
Util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority
The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from th…
-
High 7.8
util-linux libmount Privilege Escalation via Failed Mount Helper
util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owne…
-
High 7.8
Util-linux: util-linux: restricted bind mounts do not pin the source, allowing x-mount.owner/group/mode redirection
A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to…
-
High 7.0
util-linux mount hook_owner TOCTOU allows local privilege escalation
util-linux is a random collection of Linux utilities. In util-linux 2.39 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility's `hook_owner.c` post-mount hook performs path-based `chmod()` and `lchown()` operations on a previously validated mount …
-
High 7.0CVE-2026-53613 Public exploit
util-linux mount target TOCTOU allows local privilege escalation
util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy `mount(2)` path is used without `/proc`, restricted non-root `mount` requests validate an `/etc/fstab` target before…
-
High 7.0
util-linux LIBMOUNT_FORCE_MOUNT2 allows nosuid and noexec bypass
util-linux is a random collection of Linux utilities. In util-linux 2.39.1 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility reads the attacker-controlled `LIBMOUNT_FORCE_MOUNT2` environment variable with `getenv()`, allowing a local low-privil…
-
Medium 6.8
Util-linux: util-linux: heap use-after-free in libblkid nested partition probing
A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition ad…
-
Medium 4.7
util-linux: TOCTOU Race Condition in util-linux mount(8) - Loop Device Setup
util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates …