CVE-2026-53614

Awaiting Analysis Awaiting Analysis - Queue

Race Condition in util-linux mount Utility Allows Privilege Escalation

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: GitHub, Inc.

Description

util-linux is a random collection of Linux utilities. In util-linux 2.39.1 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility reads the attacker-controlled `LIBMOUNT_FORCE_MOUNT2` environment variable with `getenv()`, allowing a local low-privileged user to force the non-atomic legacy bind-mount path. With an `/etc/fstab` bind mount authorized by `user` or `users` and protected by `nosuid`, `noexec`, or `nodev`, an attacker can race the window between the initial bind mount and the remount that applies those security flags and execute a SUID program from the temporarily unprotected mount, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-53614

EUVD

EUVD-2026-101304

Affected Vendors & Products

Vendor	Product	Version / Range
util-linux	util-linux	>= 2.39.1, < 2.41.5
util-linux	util-linux	>= 2.42, < 2.42.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-807	The product uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypasses the protection mechanism.
CWE-269	The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

Executive Summary

This is a local privilege escalation vulnerability in the util-linux package affecting the SUID binary /usr/bin/mount. It involves the improper handling of the LIBMOUNT_FORCE_MOUNT2 environment variable, which can be set by an unprivileged user to bypass security restrictions. The vulnerability occurs because the mount binary uses a raw getenv() call to read LIBMOUNT_FORCE_MOUNT2 in a SUID context, allowing an attacker to force the use of an insecure legacy mount path that performs bind mounts in two separate syscalls without atomic security flag application.

Detection Guidance

Check util-linux version with 'mount --version' or 'rpm -q util-linux' on RPM-based systems. Vulnerable versions are 2.39.1 through 2.41.4 and 2.42 through 2.42.1. Review /etc/fstab for entries with 'bind,user' or 'bind,users' options combined with 'nosuid', 'noexec', or 'nodev'.

Impact Analysis

An attacker with local low privileges could exploit this to gain root access. The attack requires an /etc/fstab entry with bind,user,nosuid,noexec options and a SUID root binary in the bind source directory. The attacker races the window between the initial unprotected bind mount and the remount applying security flags, executing a SUID program during this brief interval to gain persistent root privileges.

Compliance Impact

This vulnerability primarily affects local system security by allowing privilege escalation to root via a race condition in mount operations. While not directly impacting GDPR or HIPAA compliance, it could indirectly compromise systems handling sensitive data by enabling unauthorized root access, potentially leading to data breaches or unauthorized modifications of protected health or personal information.

Mitigation Strategies

Upgrade util-linux to version 2.41.5 or 2.42.2 or later. Remove or modify any /etc/fstab bind mount entries with 'user' or 'users' options. Temporarily set LIBMOUNT_FORCE_MOUNT2 to 'never' in /etc/environment until patched.

Hi! I’m here to help you understand CVE-2026-53614. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70