CVE-2026-78410
Received Received - Intake

Privileged Mount Redirection in util-linux

Publication date: 2026-09-02

Last updated on: 2026-09-02

Assigner: redhat-SADP

Description
A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-02
Last Modified
2026-09-02
Generated
2026-09-02
AI Q&A
2026-09-02
EPSS Evaluated
N/A
NVD
CVE-2026-78410
EUVD
EUVD-2026-70106

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
util-linux util-linux From 2.39 (inc) to 2.42.2 (inc)
util-linux util-linux 2.41.6
util-linux util-linux 2.42.3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-367 The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-78410 is a flaw in util-linux where restricted bind mounts do not properly pin the source path before privileged mount operations. A local unprivileged user can replace the source or a writable ancestor with a symlink, redirecting SUID mount(8) to bind an attacker-controlled directory. If fstab entries use X-mount.owner, X-mount.group, or X-mount.mode, root may then change ownership or permissions on the redirected inode, enabling unauthorized access.

Detection Guidance

Check if your system uses util-linux versions 2.39 through 2.42.2, which are affected. Run 'mount -v | grep bind' or 'cat /etc/fstab | grep bind' to identify restricted bind mounts with X-mount.owner, X-mount.group, or X-mount.mode options. Look for user-writable ancestors in the bind source paths.

Impact Analysis

This vulnerability allows a local attacker to escalate privileges by redirecting mount operations to unauthorized directories. If fstab entries use X-mount options, the attacker can modify ownership or permissions on sensitive paths, potentially gaining control over critical system files or directories.

Compliance Impact

This vulnerability could lead to unauthorized access or modification of sensitive data, violating confidentiality and integrity requirements in GDPR and HIPAA. Unauthorized changes to file ownership or permissions may result in non-compliance with data protection standards.

Mitigation Strategies

Upgrade util-linux to v2.41.6, v2.42.3, or later. If upgrading is not possible, remove or modify /etc/fstab entries with restricted bind mounts and X-mount.owner, X-mount.group, or X-mount.mode options. Avoid user-writable ancestors in bind source paths.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-78410. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart