CVE-2026-53613

Awaiting Analysis Awaiting Analysis - Queue

Path Traversal in util-linux via fstab Mount Validation Bypass

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: GitHub, Inc.

Description

util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy `mount(2)` path is used without `/proc`, restricted non-root `mount` requests validate an `/etc/fstab` target before the mount operation re-resolves that pathname. A local low-privileged user authorized by an fstab `user` or `users` entry whose target has an attacker-writable ancestor can use `renameat2(RENAME_EXCHANGE)` to swap a path component and redirect an authorized mount to a root-owned location, such as mounting attacker-controlled content over `/etc/sudoers.d`, and thereby gain root privileges. Versions 2.41.5 and 2.42.2 pin targets for the new mount API, and 2.42.4 pins legacy targets through `/proc/self/fd`; the documented legacy fallback without `/proc` remains affected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-53613

EUVD

EUVD-2026-101124

Affected Vendors & Products

Vendor	Product	Version / Range
util-linux	util-linux	>= 2.17, <= 2.41.6
util-linux	util-linux	>= 2.42, <= 2.42.4

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-367	The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.

Attack-Flow Graph

Executive Summary

CVE-2026-53613 is a Local Privilege Escalation vulnerability in the util-linux package affecting the SUID binary /usr/bin/mount. It involves a Time-of-Check-to-Time-of-Use (TOCTOU) race condition where restricted non-root mount requests validate an /etc/fstab target before the mount operation re-resolves that pathname. An attacker can exploit this by using renameat2(RENAME_EXCHANGE) to redirect an authorized mount to a root-owned location, such as mounting attacker-controlled content over /etc/sudoers.d, and thereby gain root privileges.

Detection Guidance

Check util-linux version with 'mount --version' or 'rpm -q util-linux' on RPM-based systems or 'dpkg -l util-linux' on Debian-based systems. Vulnerable versions are 2.17 through 2.41.6, 2.42 through 2.42.3, and 2.42.4 without /proc. Review /etc/fstab for entries with 'user' or 'users' options where mount targets have writable ancestor directories.

Impact Analysis

This vulnerability allows a local low-privileged user authorized by an fstab user or users entry to escalate privileges to root by mounting attacker-controlled content over sensitive system files like /etc/sudoers.d. Exploitation requires an /etc/fstab entry with the user or users option where the mount target path contains an ancestor directory writable by the attacker.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by enabling unauthorized root access through local privilege escalation. If exploited, attackers could gain control over critical system files like /etc/sudoers.d, potentially bypassing authentication mechanisms and accessing sensitive data. This undermines data integrity and confidentiality requirements in GDPR and HIPAA.

Mitigation Strategies

Upgrade util-linux to versions 2.41.5 or 2.42.2 or later which include patches for this TOCTOU vulnerability.
Ensure /etc/fstab mount targets for user mounts do not traverse writable directories by non-root users.
Avoid using the legacy mount(2) path without /proc; prefer the new mount API if available.
Monitor for suspicious mount activity or unauthorized changes to system directories like /etc/sudoers.d.

Hi! I’m here to help you understand CVE-2026-53613. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70