util-linux SUID mount: two race-condition flaws (CVE-2026-53612, CVE-2026-53613; CVSS 7.0) let a local user with an fstab user mount entry gain root; fixed in 2.41.5, 2.42.2 and 2.42.4

The util-linux project published two security advisories with CVE records on 14 October 2026 for the set-user-ID mount utility shipped by nearly every Linux distribution. Both need a local low-privileged user whom /etc/fstab already allows to mount something (a user or users entry), and both are time-of-check to time-of-use races won by swapping a path component with renameat2(RENAME_EXCHANGE) in an ancestor directory the attacker can write to. CVE-2026-53612 (GHSA-g8wm-75wr-g2vh) is in the hook_owner post-mount hook: when the fstab entry also sets X-mount.mode, X-mount.owner or X-mount.group, mount runs chmod and lchown on a path that can be redirected to a root-owned file. It affects 2.39 through 2.41.4 and 2.42 through 2.42.1. CVE-2026-53613 (GHSA-8gj5-72r3-428g) is in restricted non-root mount requests, which check the fstab target and then resolve the path again, so the mount can be redirected to somewhere like /etc/sudoers.d. It affects 2.17 through 2.41.6 and 2.42 through 2.42.3, and 2.42.4 when the legacy mount(2) path is used without /proc. Both are rated CVSS 3.1 7.0 (local, high complexity). No exploitation has been reported. Primary: util-linux GitHub advisories and CVE records.

Product

util-linux mount (set-user-ID) on Linux

Versions

CVE-2026-53612: 2.39–2.41.4 and 2.42–2.42.1. CVE-2026-53613: 2.17–2.41.6 and 2.42–2.42.3; 2.42.4 legacy mount(2) path without /proc

CVSS

7.0

Exploited in Australia?

unknown

Patch to

Install your distribution's util-linux update (upstream fixes in 2.41.5, 2.42.2 and 2.42.4; the legacy no-/proc fallback stays affected). Meanwhile review /etc/fstab for user or users entries, especially ones with X-mount.owner/group/mode, and make sure no ancestor of those mount points is writable by ordinary users.

Primary: util-linux — GHSA-8gj5-72r3-428g, mount target TOCTOU (CVE-2026-53613; 14 Oct 2026) · Vendor: util-linux — GHSA-g8wm-75wr-g2vh, mount hook_owner TOCTOU (CVE-2026-53612; 14 Oct 2026) · CVE: CVE-2026-53612, CVE-2026-53613 · CVE.org — CVE-2026-53613 record (published 14 Oct 2026)

vulnerabilities