Summary
It was discovered that libblkid in util-linux had a heap use-after-free
vulnerability during nested partition probing. An attacker who could
present a crafted block device image could possibly use this issue to
obtain sensitive information or cause a denial of service. (CVE-2026-13595)
It was discovered that the mount utility in util-linux had a time-of-check-
time-of-use vulnerability when setting up loop devices. A local attacker
could possibly use this issue to obtain unauthorized read access to root-
protected files and block devices. (CVE-2026-27456)
It was discovered that the login utility in util-linux improperly
canonicalized hostnames when invoked with the -h option. A remote attacker
could possibly use this issue to bypass host-based access control rules.
This issue only affected Ubuntu 26.04 LTS. (CVE-2026-3184)
It was discovered that libmount in util-linux had a time-of-check-time-of-
use vulnerability in its ownership hook. A local attacker could possibly
use this issue to gain elevated privileges. This issue only affected Ubuntu
24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-53612)
It was discovered that libmount in util-linux had a time-of-check-time-of-
use vulnerability that allowed target path redirection during mount
operations. A local attacker could possibly use this issue to gain elevated
privileges. (CVE-2026-53613)
It was discovered that libmount in util-linux improperly handled the
LIBMOUNT_FORCE_MOUNT2 environment variable in the SUID mount utility. A
local attacker could possibly use this issue to bypass nosuid and noexec
mount options and gain elevated privileges. This issue only affected Ubuntu
24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-53614)
It was discovered that libblkid in util-linux had an integer overflow
vulnerability when parsing DOS partition tables. An attacker who could
present a crafted block device image could possibly use this issue to cause
a denial of service. (CVE-2026-53615)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | util-linux | 2.37.2-4ubuntu3.6 |
| Ubuntu · 24.04 LTS 24.04:LTS | util-linux | 2.39.3-9ubuntu6.6 |
| Ubuntu · 26.04 LTS 26.04:LTS | util-linux | 2.41.3-3ubuntu2.2 |
Vulnerabilities 7
-
High 8.0
util-linux libblkid DOS extended-partition overflow produces invalid partition metadata
util-linux is a random collection of Linux utilities. Before util-linux 2.41.4, `parse_dos_extended()` in `libblkid/src/partitions/dos.c` computes an extended-partition start sector with 32-bit addition and does not apply the extended-area bounds checks to th…
-
High 7.0
util-linux mount hook_owner TOCTOU allows local privilege escalation
util-linux is a random collection of Linux utilities. In util-linux 2.39 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility's `hook_owner.c` post-mount hook performs path-based `chmod()` and `lchown()` operations on a previously validated mount …
-
High 7.0CVE-2026-53613 Public exploit
util-linux mount target TOCTOU allows local privilege escalation
util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy `mount(2)` path is used without `/proc`, restricted non-root `mount` requests validate an `/etc/fstab` target before…
-
High 7.0
util-linux LIBMOUNT_FORCE_MOUNT2 allows nosuid and noexec bypass
util-linux is a random collection of Linux utilities. In util-linux 2.39.1 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility reads the attacker-controlled `LIBMOUNT_FORCE_MOUNT2` environment variable with `getenv()`, allowing a local low-privil…
-
Medium 6.8
Util-linux: util-linux: heap use-after-free in libblkid nested partition probing
A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition ad…
-
Medium 4.7
util-linux: TOCTOU Race Condition in util-linux mount(8) - Loop Device Setup
util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates …
-
Low 3.7
Util-linux: util-linux: access control bypass due to improper hostname canonicalization
A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially …
References
-
report
https://ubuntu.com/security/CVE-2026-3184
-
report
https://ubuntu.com/security/CVE-2026-13595
-
report
https://ubuntu.com/security/CVE-2026-27456
-
report
https://ubuntu.com/security/CVE-2026-53612
-
report
https://ubuntu.com/security/CVE-2026-53613
-
report
https://ubuntu.com/security/CVE-2026-53614
-
report
https://ubuntu.com/security/CVE-2026-53615