Skip to content
OpenAdvisories
High · 7.0 CVE-2026-53614 EUVD-2026-101304

util-linux LIBMOUNT_FORCE_MOUNT2 allows nosuid and noexec bypass

Published Oct 14, 2026 · Updated Oct 15, 2026 · Assigned by GitHub_M

Vendor: util-linux Product: util-linux Package: util-linux Package: util-linux Package: util-linux Package: util-linux Platform: Linux Ecosystem: Alpine Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Ubuntu

Description

util-linux is a random collection of Linux utilities. In util-linux 2.39.1 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility reads the attacker-controlled `LIBMOUNT_FORCE_MOUNT2` environment variable with `getenv()`, allowing a local low-privileged
user to force the non-atomic legacy bind-mount path. With an `/etc/fstab` bind mount authorized by `user` or `users` and protected by `nosuid`, `noexec`, or `nodev`, an attacker can race the window between the initial bind mount and the remount that applies those security flags and execute a SUID program from the temporarily unprotected mount, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2.

Affected products

VendorProductAffectedFixed
util-linux util-linux >= 2.39.1, < 2.41.5, >= 2.42, < 2.42.2 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 util-linux 2.42.2-1 —
Debian 13 util-linux 2.41.5-0+deb13u1 —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 util-linux No fix yet —
Ubuntu 26.04 LTS util-linux 2.41.3-3ubuntu2.2 USN-8702-1
Ubuntu 25.10 util-linux No fix yet —
Ubuntu 24.04 LTS util-linux 2.39.3-9ubuntu6.6 USN-8702-1
Ubuntu 22.04 LTS util-linux 2.37.2-4ubuntu3.6 USN-8702-1

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 10 uuidd +13 2.40.2-18.el10_2.20 RHSA-2026:93461

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 10 uuidd +13 2.40.2-18.el10_2.20 ALSA-2026:93461

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 10 util-linux 2.40.2-18.el10_2.20 RLSA-2026:93461

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 util-linux +1 2.40.4-150700.4.18.1 SUSE-SU-2026:3684-1
SLES 15 SP6 util-linux +1 2.39.3-150600.4.26.1 SUSE-SU-2026:3685-1
Show 6 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 16.0 util-linux +2 2.41.1-160000.5.1 SUSE-SU-2026:23870-1, SUSE-SU-2026:23861-1
SLES for SAP 15 SP6 util-linux +1 2.39.3-150600.4.26.1 SUSE-SU-2026:3685-1
SLES 16.0 util-linux +2 2.41.1-160000.5.1 SUSE-SU-2026:23870-1, SUSE-SU-2026:23861-1
SLE Micro 6.2 util-linux +1 2.41.1-160000.5.1 SUSE-SU-2026:23884-1
SLE Micro 6.1 util-linux +1 2.40.4-slfo.1.1_7.1 SUSE-SU-2026:23255-1
SLE Micro 6.0 util-linux +1 2.39.3-8.1 SUSE-SU-2026:23250-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed util-linux 2.42.2-1.1 openSUSE-SU-2026:11408-1
openSUSE Leap 16.0 util-linux +2 2.41.1-160000.5.1 openSUSE-SU-2026:21905-1

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.24 util-linux 2.42.3-r0 —
Alpine v3.23 util-linux 2.41.6-r0 —
Alpine v3.22 util-linux 2.41.6-r0 —

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 util-linux 2.40.2-7 —

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 10 uuidd +13 2.40.2-18.0.1.el10_2.20 ELSA-2026-93461

Advisories 16

References