Executive brief
A vulnerability in the 'mount' utility, a standard component of Linux operating systems, could allow a local user to gain unauthorized access to sensitive files. By exploiting a timing issue during the process of mounting disk images, an attacker can trick the system into opening and mounting restricted files or hardware devices that should only be accessible by administrators. This could lead to the exposure of private data, system backups, or entire disk volumes.
Technical details
A TOCTOU race condition exists in the SUID 'mount' binary of util-linux when setting up loop devices. The vulnerability occurs because the binary performs path validation using unprivileged credentials via a fork/setuid pattern, but subsequently re-canonicalizes and opens the path using root privileges (euid=0). An attacker can use a race condition (e.g., via renameat2) to replace the validated file with a symlink to a root-owned file or device between these two phases. The exploit is successful because the open() call lacks O_NOFOLLOW and the process does not perform inode comparison or post-open fstat() checks. Exploitation requires an /etc/fstab entry with 'user' and 'loop' options pointing to a directory writable by the attacker. This issue is fixed in version 2.41.4.
Affected products
- util-linux util-linux < 2.41.4
Timeline
- 2026-04-01: patched: Fixed in version 2.41.4
- 2026-04-03: disclosed: Initial CVE publication