util-linux: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 2

• High 7.8
  CVE-2026-78410

  Util-linux: util-linux: restricted bind mounts do not pin the source, allowing x-mount.owner/group/mode redirection

  A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux Alpine
  Sep 2, 2026
• High 7.0
  CVE-2026-78409

  Util-linux: util-linux: x-mount.subdir detached-tree resolution can escape via intermediate symlinks

  The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Alpine
  Sep 2, 2026

Revision history

1. 2026-11-04 #7

   Neue Updates von Red Hat aufgenommen

2. 2026-11-02 #6

   Neue Updates von Oracle Linux aufgenommen

3. 2026-11-01 #5

   Neue Updates von Red Hat aufgenommen

4. 2026-09-29 #4

   Neue Updates von SUSE aufgenommen

5. 2026-09-24 #3

   Neue Updates von SUSE und openSUSE aufgenommen

6. 2026-09-03 #2

   Neue Updates von Red Hat aufgenommen

7. 2026-09-02 #1

   Initiale Fassung

References

• util-linux Security Advisories vom 2026-09-02
  https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv
• util-linux Security Advisories vom 2026-09-02
  https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m
• Red Hat Security Advisory RHSA-2026:63162 vom 2026-09-03
  https://access.redhat.com/errata/RHSA-2026:63162
• SUSE Security Update SUSE-SU-2026:23870-1 vom 2026-09-24
  https://lists.suse.com/pipermail/sle-security-updates/2026-September/029380.html
• SUSE Security Update SUSE-SU-2026:23861-1 vom 2026-09-24
  https://lists.suse.com/pipermail/sle-security-updates/2026-September/029388.html
• openSUSE Security Update OPENSUSE-SU-2026:21905-1 vom 2026-09-24
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/7XWCSBBTVCSXQWGPUUFJDPOE2HJD3YK5/
• SUSE Security Update SUSE-SU-2026:23884-1 vom 2026-09-29
  https://lists.suse.com/pipermail/sle-security-updates/2026-September/029450.html
• Red Hat Security Advisory RHSA-2026:93461 vom 2026-11-02
  https://access.redhat.com/errata/RHSA-2026:93461
• Oracle Linux Security Advisory ELSA-2026-93461 vom 2026-11-02
  https://linux.oracle.com/errata/ELSA-2026-93461.html
• Rocky Linux Security Advisory RLSA-2026:93461 vom 2026-11-03
  https://errata.build.resf.org/RLSA-2026:93461
• Red Hat Security Advisory RHSA-2026:95365 vom 2026-11-05
  https://access.redhat.com/errata/RHSA-2026:95365