CVE-2026-76642
Fixed in a distro release EPSS <1%CVSS 7.8
util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.
Products: util-linux
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine 3.22 | util-linux | 2.41.6-r0 |
| Alpine 3.23 | util-linux | 2.41.6-r0 |
| Alpine 3.24 | util-linux | 2.42.3-r0 |
| Debian 12 | util-linux | no fix |
| Debian 13 | util-linux | no fix |
| Debian 14 | util-linux | 2.42.3-1 |
| Red Hat hummingbird 1 | libblkid | 0:2.42.2-3.4.hum1 |
| Red Hat hummingbird 1 | libblkid-devel | 0:2.42.2-3.4.hum1 |
| Red Hat hummingbird 1 | libfdisk | 0:2.42.2-3.4.hum1 |
| Red Hat hummingbird 1 | libfdisk-devel | 0:2.42.2-3.4.hum1 |
| Red Hat hummingbird 1 | liblastlog2 | 0:2.42.2-3.4.hum1 |
| Red Hat hummingbird 1 | liblastlog2-devel | 0:2.42.2-3.4.hum1 |
| Red Hat hummingbird 1 | libmount | 0:2.42.2-3.4.hum1 |
| Red Hat hummingbird 1 | libmount-devel | 0:2.42.2-3.4.hum1 |
| Red Hat hummingbird 1 | libsmartcols | 0:2.42.2-3.4.hum1 |
| Red Hat hummingbird 1 | libsmartcols-devel | 0:2.42.2-3.4.hum1 |
| Red Hat hummingbird 1 | libuuid | 0:2.42.2-3.4.hum1 |
| Red Hat hummingbird 1 | libuuid-devel | 0:2.42.2-3.4.hum1 |
| Red Hat hummingbird 1 | python3-libmount | 0:2.42.2-3.4.hum1 |
| Red Hat hummingbird 1 | util-linux | 0:2.42.2-3.4.hum1 |
| Red Hat hummingbird 1 | util-linux-core | 0:2.42.2-3.4.hum1 |
| Red Hat hummingbird 1 | util-linux-i18n | 0:2.42.2-3.4.hum1 |
| Red Hat hummingbird 1 | util-linux-script | 0:2.42.2-3.4.hum1 |
| Red Hat hummingbird 1 | uuidd | 0:2.42.2-3.4.hum1 |
| SUSE Linux Enterprise Server 16.0 | python-libmount | 2.41.1-160000.5.1 |
| SUSE Linux Enterprise Server 16.0 | util-linux | 2.41.1-160000.5.1 |
| SUSE Linux Enterprise Server 16.0 | util-linux-systemd | 2.41.1-160000.5.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | python-libmount | 2.41.1-160000.5.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | util-linux | 2.41.1-160000.5.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | util-linux-systemd | 2.41.1-160000.5.1 |
| SUSE Linux Micro 6.2 | util-linux | 2.41.1-160000.5.1 |
| SUSE Linux Micro 6.2 | util-linux-systemd | 2.41.1-160000.5.1 |
| Ubuntu 14.04 LTS | util-linux | no fix |
| Ubuntu 18.04 LTS | util-linux | no fix |
| Ubuntu 22.04 LTS | util-linux | no fix |
| Ubuntu 24.04 LTS | util-linux | no fix |
| Ubuntu 26.04 LTS | util-linux | no fix |
| Ubuntu 26.10 | util-linux | no fix |
| Ubuntu Pro 16.04 LTS | util-linux | no fix |
| Ubuntu Pro 20.04 LTS | util-linux | no fix |
| openSUSE Leap 16.0 | python-libmount | 2.41.1-160000.5.1 |
| openSUSE Leap 16.0 | util-linux | 2.41.1-160000.5.1 |
| openSUSE Leap 16.0 | util-linux-systemd | 2.41.1-160000.5.1 |
| openSUSE Tumbleweed | util-linux | 2.42.3-1.1 |