CVE-2026-78410 Util-linux: util-linux: restricted bind mounts do not pin the source, allowing x-mount.owner/group/mode redirection

A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount8 to bind another host directory. If the fst...

CVE-2026-78410 Util-linux: util-linux: restricted bind mounts do not pin the source, allowing x-mount.owner/group/mode redirection

A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount8 to bind another host directory. If the fst...

CVE-2026-78410

util-linux is affected by a flaw in how restricted bind mounts are handled. The source path taken from /etc/fstab is not pinned before the privileged mount(8) call, allowing a local unprivileged user who can replace the authorized source or a writable ancestor to redirect the SUID mount to bind a...

CVE-2026-78410

A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount8 to bind another host directory. If the fst...

CVE-2026-78408 Util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority

The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve. Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an...

CVE-2026-78408 Util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority

The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve. Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an...

CVE-2026-78408

util-linux nsenter --join-cgroup opens the target cgroup.procs file as root and leaves the file descriptor open across subsequent namespace, credential, and execve() transitions. Because the kernel evaluates later cgroup migrations against the credentials of the original open, a process in an att...

CVE-2026-78410

A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount8 to bind another host directory. If the fst...

CVE-2026-78409

The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to opentree with ATSYMLINKNOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with...

CVE-2026-78408

The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve. Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an...

CVE-2026-76642

When an external mount. helper runs but exits with a nonzero status, libmount still treats the helper invocation as successful and runs privileged post-mount hooks. A local unprivileged user with an /etc/fstab entry that uses the user option together with X-mount.idmap or X-mount.owner/group/mode...

PT-2026-84766

Name of the Vulnerable Software and Affected Versions util-linux affected versions not specified Description A flaw exists where restricted bind mounts retrieve the source path from fstab without pinning the source before the privileged mount occurs. This allows a local unprivileged user who can...

PT-2026-84982

Name of the Vulnerable Software and Affected Versions util-linux versions prior to 2.41.6 util-linux version 2.42.2 Description The software fails to verify the exit status of mount helpers before executing post-mount hooks. This allows unprivileged users to perform privileged operations on...

Linux Distros Unpatched Vulnerability : CVE-2026-78410

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local...

CVE-2026-78410: Time-of-check Time-of-use (TOCTOU) Race Condition

A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount8 to bind another host directory. If the fst...

USN-8702-1: util-linux vulnerabilities

It was discovered that libblkid in util-linux had a heap use-after-free vulnerability during nested partition probing. An attacker who could present a crafted block device image could possibly use this issue to obtain sensitive information or cause a denial of service. CVE-2026-13595 It was...

USN-8702-1 util-linux vulnerabilities

It was discovered that libblkid in util-linux had a heap use-after-free vulnerability during nested partition probing. An attacker who could present a crafted block device image could possibly use this issue to obtain sensitive information or cause a denial of service. CVE-2026-13595 It was...

The vulnerability of the Util-linux command-line utility suite relates to insufficient checking of the status of shared resources, which allows a perpetrator to trigger a service failure.

The vulnerability of the Util-linux command-line utility package relates to insufficient checking of the status of shared resources. Exploiting this vulnerability could allow an attacker to cause service failures...

The vulnerability of the Util-linux command-line utility suite relates to the use of memory after it is freed, allowing an attacker to trigger a service failure.

The vulnerability of the Util-linux command-line utility suite relates to the use of memory after it is freed. Exploiting this vulnerability could allow an attacker to cause a service failure...

Security update for util-linux

This update for util-linux fixes the following issues: CVE-2026-13595: heap use-after-free read in libblkid nested partition probing bsc1269583. CVE-2026-27456: TOCTOU race condition in the mount program when setting up loop devices bsc1261606. Several security issues in releases prior to v2.42.2...