Is CVE-2026-27456 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-27456 being exploited in the wild.

How severe is CVE-2026-27456?

Medium severity, with a CVSS score of 4.7, published 3 April 2026.

Which products and versions are affected?

util-linux util-linux < 2.41.4.

Is there a fix for CVE-2026-27456?

A patch was published on 2026-04-01: Fixed in version 2.41.4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-27456 attacked?

It is attacked with local access, in an operating system.

Am I affected by CVE-2026-27456?

Check whether you run Kernel Util-Linux. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-27456: util-linux mount TOCTOU race condition in loop device setup

Q: Is there a fix for CVE-2026-27456?

A patch was published on 2026-04-01: Fixed in version 2.41.4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-27456 attacked?

It is attacked with local access, in an operating system.

Q: Am I affected by CVE-2026-27456?

Check whether you run Kernel Util-Linux. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-27456 · Severity: medium · CVSS 4.7 · Published 2026-04-03

A vulnerability in the 'mount' utility, a standard component of Linux operating systems, could allow a local user to gain unauthorized access to sensitive files. By exploiting a timing issue during the process of mounting disk images, an attacker can trick the system into opening and mounting restricted files or hardware devices that should only be accessible by administrators. This could lead to the exposure of private data, system backups, or entire disk volumes.

Technologies: Kernel Util-Linux. Vendors: Kernel.

Quick answers

Is CVE-2026-27456 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-27456 being exploited in the wild.
How severe is CVE-2026-27456?: Medium severity, with a CVSS score of 4.7, published 3 April 2026.
Which products and versions are affected?: util-linux util-linux < 2.41.4.
Is there a fix for CVE-2026-27456?: A patch was published on 2026-04-01: Fixed in version 2.41.4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-27456 attacked?: It is attacked with local access, in an operating system.
Am I affected by CVE-2026-27456?: Check whether you run Kernel Util-Linux. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A TOCTOU race condition exists in the SUID 'mount' binary of util-linux when setting up loop devices. The vulnerability occurs because the binary performs path validation using unprivileged credentials via a fork/setuid pattern, but subsequently re-canonicalizes and opens the path using root privileges (euid=0). An attacker can use a race condition (e.g., via renameat2) to replace the validated file with a symlink to a root-owned file or device between these two phases. The exploit is successful because the open() call lacks O_NOFOLLOW and the process does not perform inode comparison or post-open fstat() checks. Exploitation requires an /etc/fstab entry with 'user' and 'loop' options pointing to a directory writable by the attacker. This issue is fixed in version 2.41.4.

Affected products

util-linux util-linux < 2.41.4

Timeline

2026-04-01: patched: Fixed in version 2.41.4
2026-04-03: disclosed: Initial CVE publication

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.