util-linux is a random collection of Linux utilities. In util-linux 2.39 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility's `hook_owner.c` post-mount hook performs path-based `chmod()` and `lchown()` operations on a previously validated mount target. A local low-privileged user authorized by an `/etc/fstab` entry with `user` or `users` and an `X-mount.mode`, `X-mount.owner`, or `X-mount.group` option can use `renameat2(RENAME_EXCHANGE)` to race a writable ancestor of the target and redirect the privileged ownership or mode change to a root-owned path, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2.

Affected: openEuler:24.03-LTS-SP1: util-linux

The util-linux package contains a random collection of files that implements some low-level basic linux utilities. Security Fix(es):

CVE-2026-53612 has no publicly disclosed vulnerability details yet. It is only indexed by the Snyk data source. Details are pending disclosure.(CVE-2026-53612)

When an /etc/fstab entry is configured with the user or users option, mount(8) validates the target path before performing the mount syscall, creating a Time-of-Check-Time-of-Use (TOCTOU) window. A local unprivileged user with write access to an ancestor directory of the mount target can swap that directory to redirect the mount to an arbitrary root-owned location, potentially escalating privileges to root.(CVE-2026-53613)

A flaw was found in util-linux. The mount(8) SUID binary does not sanitize the LIBMOUNT_FORCE_MOUNT2 environment variable before use. A local unprivileged user can set this variable to force mount(8) to use the legacy two-step mount(2) code path, which applies security restrictions such as nosuid and noexec after the mount is already active. During this window, an attacker can execute a SUID binary from the mounted filesystem, allowing local privilege escalation to root. Affected versions: util-linux v2.39.1 through v2.43-devel (current master).(CVE-2026-53614)

A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized sour…

libblkid-devel-2.42.2-1.1 on GA media

Security update for util-linux

Affected: Ubuntu:24.04:LTS: util-linux, Ubuntu:25.10: util-linux, Ubuntu:26.04:LTS: util-linux

[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]

Ein lokaler Angreifer kann mehrere Schwachstellen in util-linux ausnutzen, um Administratorrechte zu erlangen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren oder einen Denial-of-Service-Zustand auszulösen.