CVE-2026-53612

Awaiting Analysis Awaiting Analysis - Queue

Privilege Escalation in util-linux via Race Condition in mount Utility

Publication date: 2026-10-14

Last updated on: 2026-10-16

Assigner: GitHub, Inc.

Description

util-linux is a random collection of Linux utilities. In util-linux 2.39 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility's `hook_owner.c` post-mount hook performs path-based `chmod()` and `lchown()` operations on a previously validated mount target. A local low-privileged user authorized by an `/etc/fstab` entry with `user` or `users` and an `X-mount.mode`, `X-mount.owner`, or `X-mount.group` option can use `renameat2(RENAME_EXCHANGE)` to race a writable ancestor of the target and redirect the privileged ownership or mode change to a root-owned path, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-53612

EUVD

EUVD-2026-101123

Affected Vendors & Products

Vendor	Product	Version / Range
util-linux	util-linux	>= 2.39, < 2.41.5
util-linux	util-linux	>= 2.42, < 2.42.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-367	The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.

Attack-Flow Graph

Executive Summary

This is a local privilege escalation vulnerability in the util-linux package affecting the SUID binary /usr/bin/mount. It involves a Time-of-Check-Time-of-Use (TOCTOU) race condition in hook_owner.c where chmod() and lchown() operations are performed on a mount target path after mounting without verifying the path still resolves to the same filesystem object. An attacker can exploit this by swapping an intermediate directory during the race window to redirect operations to arbitrary files, allowing modification of permissions or ownership to gain root access.

Detection Guidance

Check the util-linux version installed on your system with 'mount --version' or 'dpkg -l util-linux'. If the version is between 2.39 and 2.41.4 or 2.42 and 2.42.1, the system is vulnerable. Review /etc/fstab for entries with 'user', 'users', and 'X-mount.mode', 'X-mount.owner', or 'X-mount.group' options.

Impact Analysis

An unprivileged local attacker could exploit this to modify permissions or ownership of any file on the system, leading to full root compromise. For example, setting the SUID bit on /usr/bin/bash would allow the attacker to obtain a root shell via 'bash -p'. This requires an /etc/fstab entry with user and X-mount.mode, X-mount.owner, or X-mount.group options where the mount target path contains a writable ancestor directory.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling local privilege escalation. If exploited, an attacker could gain root access, compromising system integrity and confidentiality. This may violate data protection requirements under GDPR (e.g., unauthorized access to personal data) and HIPAA (e.g., unauthorized access to protected health information).

Mitigation Strategies

Upgrade util-linux to version 2.41.5 or 2.42.2 or later. Remove or modify any /etc/fstab entries with 'X-mount.mode', 'X-mount.owner', or 'X-mount.group' options until patched. Temporarily restrict unprivileged user access to mount operations.

Hi! I’m here to help you understand CVE-2026-53612. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70