Skip to content
OpenAdvisories
High · 7.0 Public exploit CVE-2026-53613 EUVD-2026-101124

util-linux mount target TOCTOU allows local privilege escalation

Published Oct 14, 2026 · Updated Oct 15, 2026 · Assigned by GitHub_M

Vendor: util-linux Product: util-linux Package: util-linux Package: util-linux Package: util-linux Package: util-linux Platform: Linux Ecosystem: Alpine Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Ubuntu

Description

util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy `mount(2)` path is used without `/proc`, restricted non-root `mount` requests validate an `/etc/fstab` target before the mount operation re-resolves that pathname. A local low-privileged user authorized by an fstab `user` or `users` entry whose target has an attacker-writable ancestor can use `renameat2(RENAME_EXCHANGE)` to swap a path component and redirect an authorized mount to a root-owned location, such as mounting attacker-controlled content over `/etc/sudoers.d`, and thereby gain root privileges. Versions 2.41.5 and 2.42.2 pin targets for the new mount API, and 2.42.4 pins legacy targets through `/proc/self/fd`; the documented legacy fallback without `/proc` remains affected.

Affected products

VendorProductAffectedFixed
util-linux util-linux >= 2.17, <= 2.41.6, >= 2.42, <= 2.42.4 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 util-linux 2.42.2-1 —
Debian 13 util-linux 2.41.5-0+deb13u1 —
Debian 12 util-linux No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 util-linux No fix yet —
Ubuntu 26.04 LTS util-linux 2.41.3-3ubuntu2.2 USN-8702-1
Ubuntu 25.10 util-linux No fix yet —
Ubuntu 24.04 LTS util-linux 2.39.3-9ubuntu6.6 USN-8702-1
Ubuntu 22.04 LTS util-linux 2.37.2-4ubuntu3.6 USN-8702-1
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 18.04 LTS util-linux No fix yet —
Ubuntu 14.04 LTS util-linux No fix yet —
Ubuntu Pro 20.04 LTS util-linux No fix yet —
Ubuntu Pro 16.04 LTS util-linux No fix yet —

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 10 uuidd +13 2.40.2-18.el10_2.20 ALSA-2026:93461
AlmaLinux 8 uuidd +13 2.32.1-50.el8_10 ALSA-2026:96212

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 10 util-linux 2.40.2-18.el10_2.20 RLSA-2026:93461
Rocky Linux 9 uuidd +14 2.37.4-28.el9_9 RLSA-2026:97522
Rocky Linux 8 util-linux 2.32.1-50.el8_10 RLSA-2026:96212

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 util-linux +1 2.40.4-150700.4.18.1 SUSE-SU-2026:3684-1
SLES 15 SP6 util-linux +1 2.39.3-150600.4.26.1 SUSE-SU-2026:3685-1
SLES 15 SP5 util-linux +1 2.37.4-150500.9.32.1 SUSE-SU-2026:3813-1
SLES 15 SP4 util-linux +1 2.37.2-150400.8.50.1 SUSE-SU-2026:3812-1
SLES 12 SP5 util-linux +2 2.33.2-4.57.1 SUSE-SU-2026:4296-1
Show 13 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 16.0 util-linux +2 2.41.1-160000.5.1 SUSE-SU-2026:23870-1, SUSE-SU-2026:23861-1
SLES for SAP 15 SP6 util-linux +1 2.39.3-150600.4.26.1 SUSE-SU-2026:3685-1
SLES for SAP 15 SP5 util-linux +1 2.37.4-150500.9.32.1 SUSE-SU-2026:3813-1
SLES for SAP 15 SP4 util-linux +1 2.37.2-150400.8.50.1 SUSE-SU-2026:3812-1
SLES 16.0 util-linux +2 2.41.1-160000.5.1 SUSE-SU-2026:23870-1, SUSE-SU-2026:23861-1
SLE Micro 6.2 util-linux +1 2.41.1-160000.5.1 SUSE-SU-2026:23884-1
SLE Micro 6.1 util-linux +1 2.40.4-slfo.1.1_7.1 SUSE-SU-2026:23255-1
SLE Micro 6.0 util-linux +1 2.39.3-8.1 SUSE-SU-2026:23250-1
SLE Micro 5.5 util-linux +1 2.37.4-150500.9.32.1 SUSE-SU-2026:3813-1
SLE Micro 5.4 util-linux +1 2.37.2-150400.8.50.1 SUSE-SU-2026:3812-1
SLE Micro 5.3 util-linux +1 2.37.2-150400.8.50.1 SUSE-SU-2026:3812-1
SLE HPC 15 SP5 util-linux +1 2.37.4-150500.9.32.1 SUSE-SU-2026:3813-1
SLE HPC 15 SP4 util-linux +1 2.37.2-150400.8.50.1 SUSE-SU-2026:3812-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed util-linux 2.42.2-1.1 openSUSE-SU-2026:11408-1
openSUSE Leap 16.0 util-linux +2 2.41.1-160000.5.1 openSUSE-SU-2026:21905-1

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.24 util-linux 2.42.3-r0 —
Alpine v3.23 util-linux 2.41.6-r0 —
Alpine v3.22 util-linux 2.41.6-r0 —

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 util-linux 2.40.2-7 —

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 10 uuidd +13 2.40.2-18.0.1.el10_2.20 ELSA-2026-93461
Oracle Linux 8 uuidd +13 2.32.1-50.0.1.el8_10 ELSA-2026-96212

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 22

References