CVE-2026-53612
Fixed in a distro release EPSS <1%CVSS 7.0
util-linux is a random collection of Linux utilities. In util-linux 2.39 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility's `hook_owner.c` post-mount hook performs path-based `chmod()` and `lchown()` operations on a previously validated mount target. A local low-privileged user authorized by an `/etc/fstab` entry with `user` or `users` and an `X-mount.mode`, `X-mount.owner`, or `X-mount.group` option can use `renameat2(RENAME_EXCHANGE)` to race a writable ancestor of the target and redirect the privileged ownership or mode change to a root-owned path, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2.
Products: util-linux
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine 3.22 | util-linux | 2.41.6-r0 |
| Alpine 3.23 | util-linux | 2.41.6-r0 |
| Alpine 3.24 | util-linux | 2.42.3-r0 |
| Debian 13 | util-linux | 2.41.5-0+deb13u1 |
| Debian 14 | util-linux | 2.42.2-1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP7 | util-linux | 2.40.4-150700.4.18.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP7 | util-linux-systemd | 2.40.4-150700.4.18.1 |
| SUSE Linux Enterprise Module for Server Applications 15 SP7 | util-linux-systemd | 2.40.4-150700.4.18.1 |
| SUSE Linux Enterprise Server 15 SP6-LTSS | util-linux | 2.39.3-150600.4.26.1 |
| SUSE Linux Enterprise Server 15 SP6-LTSS | util-linux-systemd | 2.39.3-150600.4.26.1 |
| SUSE Linux Enterprise Server 16.0 | python-libmount | 2.41.1-160000.5.1 |
| SUSE Linux Enterprise Server 16.0 | util-linux | 2.41.1-160000.5.1 |
| SUSE Linux Enterprise Server 16.0 | util-linux-systemd | 2.41.1-160000.5.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | util-linux | 2.39.3-150600.4.26.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | util-linux-systemd | 2.39.3-150600.4.26.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | python-libmount | 2.41.1-160000.5.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | util-linux | 2.41.1-160000.5.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | util-linux-systemd | 2.41.1-160000.5.1 |
| SUSE Linux Micro 6.0 | util-linux | 2.39.3-8.1 |
| SUSE Linux Micro 6.0 | util-linux-systemd | 2.39.3-8.1 |
| SUSE Linux Micro 6.1 | util-linux | 2.40.4-slfo.1.1_7.1 |
| SUSE Linux Micro 6.1 | util-linux-systemd | 2.40.4-slfo.1.1_7.1 |
| SUSE Linux Micro 6.2 | util-linux | 2.41.1-160000.5.1 |
| SUSE Linux Micro 6.2 | util-linux-systemd | 2.41.1-160000.5.1 |
| Ubuntu 22.04 LTS | util-linux | 2.37.2-4ubuntu3.6 |
| Ubuntu 24.04 LTS | util-linux | 2.39.3-9ubuntu6.6 |
| Ubuntu 25.10 | util-linux | no fix |
| Ubuntu 26.04 LTS | util-linux | 2.41.3-3ubuntu2.2 |
| Ubuntu 26.10 | util-linux | no fix |
| openSUSE Leap 16.0 | python-libmount | 2.41.1-160000.5.1 |
| openSUSE Leap 16.0 | util-linux | 2.41.1-160000.5.1 |
| openSUSE Leap 16.0 | util-linux-systemd | 2.41.1-160000.5.1 |
| openSUSE Tumbleweed | util-linux | 2.42.2-1.1 |