Is CVE-2026-53614 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-53614 being exploited in the wild.

How severe is CVE-2026-53614?

High severity, with a CVSS score of 7, published 14 October 2026.

Which products and versions are affected?

Util-Linux 2.39.1 through 2.41.4, 2.42 through 2.42.1.

Is there a fix for CVE-2026-53614?

Yes: fixed in 2.41.5, 2.42.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-53614 attacked?

It is attacked with local access.

Am I affected by CVE-2026-53614?

Check whether you run Util-Linux at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-53614: util-linux mount SUID privilege escalation via LIBMOUNT_FORCE_MOUNT2

CVE-2026-53614 · Severity: high · CVSS 7 · Published 2026-10-14

util-linux is a collection of essential Linux system utilities, including the `mount` command used to attach filesystems. The SUID `mount` utility improperly handles an environment variable that allows a local unprivileged attacker to bypass security restrictions and execute privileged programs, potentially gaining root access. An attacker can exploit a race condition between mounting and applying security flags on filesystems authorized for user mounting.

Technologies: Util-Linux. Vendors: Util-Linux.

Quick answers

Is CVE-2026-53614 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-53614 being exploited in the wild.
How severe is CVE-2026-53614?: High severity, with a CVSS score of 7, published 14 October 2026.
Which products and versions are affected?: Util-Linux 2.39.1 through 2.41.4, 2.42 through 2.42.1.
Is there a fix for CVE-2026-53614?: Yes: fixed in 2.41.5, 2.42.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-53614 attacked?: It is attacked with local access.
Am I affected by CVE-2026-53614?: Check whether you run Util-Linux at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 2.41.5, 2.42.2

Technical details

The SUID `mount` utility in util-linux reads the attacker-controlled `LIBMOUNT_FORCE_MOUNT2` environment variable using `getenv()` without privilege-dropping, allowing a local user to force the legacy bind-mount code path. A time-of-check-time-of-use race condition exists between the initial bind mount and the subsequent remount that applies security flags (`nosuid`, `noexec`, `nodev`); an attacker can execute a SUID binary from the temporarily unprotected mount during this window, escalating privileges. The fix uses `safe_getenv()` to ignore the variable in SUID context and blocks multi-step mount sequences for non-root users in the legacy path.

Affected products

util-linux util-linux 2.39.1 through 2.41.4, 2.42 through 2.42.1

Timeline

2026-10-14: disclosed
2026-10-14: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.