util-linux mount target TOCTOU allows local privilege escalation
Summary
| CVE | CVE-2026-53613 |
|---|---|
| State | PUBLISHED |
| Assigner | GitHub_M |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-10-14 15:17:20 UTC |
| Updated | 2026-10-16 16:00:33 UTC |
| Description | util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy `mount(2)` path is used without `/proc`, restricted non-root `mount` requests validate an `/etc/fstab` target before the mount operation re-resolves that pathname. A local low-privileged user authorized by an fstab `user` or `users` entry whose target has an attacker-writable ancestor can use `renameat2(RENAME_EXCHANGE)` to swap a path component and redirect an authorized mount to a root-owned location, such as mounting attacker-controlled content over `/etc/sudoers.d`, and thereby gain root privileges. Versions 2.41.5 and 2.42.2 pin targets for the new mount API, and 2.42.4 pins legacy targets through `/proc/self/fd`; the documented legacy fallback without `/proc` remains affected. |
Risk And Classification
Primary CVSS: v3.1 7 HIGH from [email protected]
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Problem Types: CWE-367 | CWE-367 CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Secondary | 7 | HIGH | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
| 3.1 | CNA | DECLARED | 7 | HIGH | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
CVSS v3.1 Breakdown
Attack Vector
LocalAttack Complexity
HighPrivileges Required
LowUser Interaction
NoneScope
UnchangedConfidentiality
HighIntegrity
HighAvailability
HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Util-linux | Util-linux | affected >= 2.17, <= 2.41.6 | Not specified |
| CNA | Util-linux | Util-linux | affected >= 2.42, <= 2.42.4 | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| github.com/util-linux/util-linux/releases/tag/v2.42.2 | [email protected] | github.com | |
| github.com/util-linux/util-linux/commit/a9508d216eb8977979102782672e0470... | [email protected] | github.com | |
| github.com/util-linux/util-linux/commit/2c773f336134acf016e639abb6f12ba7... | [email protected] | github.com | |
| github.com/util-linux/util-linux/releases/tag/v2.42.4 | [email protected] | github.com | |
| github.com/util-linux/util-linux/commit/472cc3fb2d4d47cca7aab2e0b59eb3fb... | [email protected] | github.com | |
| github.com/util-linux/util-linux/commit/708d1b3c51932dc5ba8082c736818771... | [email protected] | github.com | |
| github.com/util-linux/util-linux/security/advisories/GHSA-8gj5-72r3-428g | [email protected] | github.com | |
| github.com/util-linux/util-linux/commit/0d3d55975aa3492c62fd345eac38f41c... | [email protected] | github.com | |
| github.com/util-linux/util-linux/commit/646fb66603d10a7ac337e14f566f1af4... | [email protected] | github.com | |
| github.com/util-linux/util-linux/commit/39fef62bf3226abb6bb018fa8750afa0... | [email protected] | github.com | |
| github.com/util-linux/util-linux/releases/tag/v2.41.5 | [email protected] | github.com | |
| github.com/util-linux/util-linux/commit/85d16b341f7232c9dbb4884b632e1e95... | [email protected] | github.com | |
| github.com/util-linux/util-linux/commit/78a860982e036f38fe9c0b3344998df5... | [email protected] | github.com | |
| github.com/util-linux/util-linux/commit/0b010025a0e429bc80355c94db86a843... | [email protected] | github.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.