util-linux mount helper privilege escalation via unchecked exit status

Executive Summary

CVE-2026-76642 is a privilege escalation flaw in util-linux's libmount component. It occurs because the software fails to check if a mount helper exits successfully before running post-mount hooks. This allows unprivileged users to execute privileged operations on existing filesystems by exploiting hooks like X-mount.idmap or X-mount.owner. Attackers can clone filesystems with inherited setuid bits or modify inode permissions after a helper fails, leading to privilege escalation.

Useful 0 Not Useful 0

Detection Guidance

Check util-linux version with 'util-linux --version' or 'dpkg -l util-linux' on Debian-based systems. Affected versions are >=2.39 and <2.41.6 or >=2.42 and <2.42.3. Inspect mount logs for failed helpers with 'journalctl -u systemd-mount' or 'dmesg | grep mount'. Look for X-mount.idmap or X-mount.owner options in /etc/fstab or mount commands.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows local attackers to escalate privileges on affected systems. If an attacker can manipulate mount operations, they may gain root access or bypass security restrictions like nosuid, nodev, or noexec. Exploitation requires specific conditions: a SUID-root mount binary, a root-controlled fstab entry, and certain mount options like X-mount.idmap or X-mount.owner.

Useful 0 Not Useful 0

Mitigation Strategies

Update util-linux to versions 2.41.6 or 2.42.3 or later. Disable untrusted mount helpers in /etc/fstab. Remove X-mount.idmap or X-mount.owner options if not required. Restrict write access to mount-related configuration files. Monitor for unusual mount operations or privilege changes.

Useful 0 Not Useful 0