Skip to content
OpenAdvisories
Medium · 4.7 CVE-2026-27456 EUVD-2026-18864

util-linux: TOCTOU Race Condition in util-linux mount(8) - Loop Device Setup

Published Apr 3, 2026 · Updated Apr 6, 2026 · Assigned by GitHub_M

Vendor: util-linux Product: util-linux Package: util-linux Package: util-linux Package: util-linux Package: util-linux Platform: Linux Ecosystem: Alpine Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Ubuntu

Description

util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.

Affected products

VendorProductAffectedFixed
util-linux util-linux < 2.41.4 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 util-linux 2.42-1 —
Debian 13 util-linux 2.41.5-0+deb13u1 —
Debian 12 util-linux No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 util-linux No fix yet —
Ubuntu 26.04 LTS util-linux 2.41.3-3ubuntu2.2 USN-8702-1
Ubuntu 25.10 util-linux No fix yet —
Ubuntu 24.04 LTS util-linux 2.39.3-9ubuntu6.6 USN-8702-1
Ubuntu 22.04 LTS util-linux 2.37.2-4ubuntu3.6 USN-8702-1
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 18.04 LTS util-linux No fix yet —
Ubuntu 14.04 LTS util-linux No fix yet —
Ubuntu Pro 20.04 LTS util-linux No fix yet —
Ubuntu Pro 16.04 LTS util-linux No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 10 uuidd +13 2.40.2-18.el10_2.20 RHSA-2026:93461
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Red Hat Hardened Images 1 util-linux +3 2.42-7.1.hum1 RHSA-2026:7180

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 10 uuidd +13 2.40.2-18.el10_2.20 ALSA-2026:93461

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 10 util-linux 2.40.2-18.el10_2.20 RLSA-2026:93461

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 util-linux +1 2.40.4-150700.4.13.1 SUSE-SU-2026:3684-1, SUSE-SU-2026:2485-1
SLES 15 SP6 util-linux +1 2.39.3-150600.4.26.1 SUSE-SU-2026:3685-1
SLES 15 SP5 util-linux +1 2.37.4-150500.9.32.1 SUSE-SU-2026:3813-1
SLES 15 SP4 util-linux +1 2.37.2-150400.8.50.1 SUSE-SU-2026:3812-1
SLES 12 SP5 util-linux +2 2.33.2-4.54.1 SUSE-SU-2026:4296-1, SUSE-SU-2026:2492-1
Show 13 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 16.0 util-linux +2 2.41.1-160000.4.1 SUSE-SU-2026:23870-1, SUSE-SU-2026:23861-1, SUSE-SU-2026:22332-1
SLES for SAP 15 SP6 util-linux +1 2.39.3-150600.4.26.1 SUSE-SU-2026:3685-1
SLES for SAP 15 SP5 util-linux +1 2.37.4-150500.9.32.1 SUSE-SU-2026:3813-1
SLES for SAP 15 SP4 util-linux +1 2.37.2-150400.8.50.1 SUSE-SU-2026:3812-1
SLES 16.0 util-linux +2 2.41.1-160000.4.1 SUSE-SU-2026:23870-1, SUSE-SU-2026:23861-1, SUSE-SU-2026:22332-1
SLE Micro 6.2 util-linux +1 2.41.1-160000.4.1 SUSE-SU-2026:23884-1, SUSE-SU-2026:22260-1
SLE Micro 6.1 util-linux +1 2.40.4-slfo.1.1_7.1 SUSE-SU-2026:23255-1
SLE Micro 6.0 util-linux +1 2.39.3-8.1 SUSE-SU-2026:23250-1
SLE Micro 5.5 util-linux +1 2.37.4-150500.9.32.1 SUSE-SU-2026:3813-1
SLE Micro 5.4 util-linux +1 2.37.2-150400.8.47.1 SUSE-SU-2026:3812-1, SUSE-SU-2026:2653-1
SLE Micro 5.3 util-linux +1 2.37.2-150400.8.47.1 SUSE-SU-2026:3812-1, SUSE-SU-2026:2653-1
SLE HPC 15 SP5 util-linux +1 2.37.4-150500.9.32.1 SUSE-SU-2026:3813-1
SLE HPC 15 SP4 util-linux +1 2.37.2-150400.8.50.1 SUSE-SU-2026:3812-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed util-linux 2.42-1.1 openSUSE-SU-2026:10736-1
openSUSE Leap 16.0 util-linux +2 2.41.1-160000.4.1 openSUSE-SU-2026:21905-1, openSUSE-SU-2026:21028-1

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.24 util-linux 2.41.4-r0 —
Alpine v3.23 util-linux 2.41.4-r0 —
Alpine v3.22 util-linux 2.41.6-r0 —

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 util-linux 2.40.2-4 —

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 10 uuidd +13 2.40.2-18.0.1.el10_2.20 ELSA-2026-93461

Advisories 24

References