Skip to content
OpenAdvisories
High · 7.0 CVE-2026-53612 EUVD-2026-101123

util-linux mount hook_owner TOCTOU allows local privilege escalation

Published Oct 14, 2026 · Updated Oct 14, 2026 · Assigned by GitHub_M

Vendor: util-linux Product: util-linux Package: util-linux Package: util-linux Package: util-linux Package: util-linux Platform: Linux Ecosystem: Alpine Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Ubuntu

Description

util-linux is a random collection of Linux utilities. In util-linux 2.39 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility's `hook_owner.c` post-mount hook performs path-based `chmod()` and `lchown()` operations on a previously validated mount target. A local low-privileged user authorized by an `/etc/fstab` entry with `user` or `users` and an `X-mount.mode`, `X-mount.owner`, or `X-mount.group` option can use `renameat2(RENAME_EXCHANGE)` to race a writable ancestor of the target and redirect the privileged ownership or mode change to a root-owned path, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2.

Affected products

VendorProductAffectedFixed
util-linux util-linux >= 2.39, < 2.41.5, >= 2.42, < 2.42.2 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 util-linux 2.42.2-1 —
Debian 13 util-linux 2.41.5-0+deb13u1 —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 util-linux No fix yet —
Ubuntu 26.04 LTS util-linux 2.41.3-3ubuntu2.2 USN-8702-1
Ubuntu 25.10 util-linux No fix yet —
Ubuntu 24.04 LTS util-linux 2.39.3-9ubuntu6.6 USN-8702-1
Ubuntu 22.04 LTS util-linux 2.37.2-4ubuntu3.6 USN-8702-1

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 10 uuidd +13 2.40.2-18.el10_2.20 RHSA-2026:93461

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 10 uuidd +13 2.40.2-18.el10_2.20 ALSA-2026:93461

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 10 util-linux 2.40.2-18.el10_2.20 RLSA-2026:93461

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 util-linux +1 2.40.4-150700.4.18.1 SUSE-SU-2026:3684-1
SLES 15 SP6 util-linux +1 2.39.3-150600.4.26.1 SUSE-SU-2026:3685-1
Show 6 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 16.0 util-linux +2 2.41.1-160000.5.1 SUSE-SU-2026:23870-1, SUSE-SU-2026:23861-1
SLES for SAP 15 SP6 util-linux +1 2.39.3-150600.4.26.1 SUSE-SU-2026:3685-1
SLES 16.0 util-linux +2 2.41.1-160000.5.1 SUSE-SU-2026:23870-1, SUSE-SU-2026:23861-1
SLE Micro 6.2 util-linux +1 2.41.1-160000.5.1 SUSE-SU-2026:23884-1
SLE Micro 6.1 util-linux +1 2.40.4-slfo.1.1_7.1 SUSE-SU-2026:23255-1
SLE Micro 6.0 util-linux +1 2.39.3-8.1 SUSE-SU-2026:23250-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed util-linux 2.42.2-1.1 openSUSE-SU-2026:11408-1
openSUSE Leap 16.0 util-linux +2 2.41.1-160000.5.1 openSUSE-SU-2026:21905-1

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.24 util-linux 2.42.3-r0 —
Alpine v3.23 util-linux 2.41.6-r0 —
Alpine v3.22 util-linux 2.41.6-r0 —

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 util-linux 2.40.2-7 —

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 10 uuidd +13 2.40.2-18.0.1.el10_2.20 ELSA-2026-93461

Advisories 16

References