# CVE-2026-53614: util-linux mount SUID privilege escalation via LIBMOUNT_FORCE_MOUNT2

Source: https://junglewise.ai/threats/cve-2026-53614-util-linux-is-a-random-collection-of-linux-utilities-in-util  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-14. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-53614 · Severity: high · CVSS 7 · Published 2026-10-14

util-linux is a collection of essential Linux system utilities, including the `mount` command used to attach filesystems. The SUID `mount` utility improperly handles an environment variable that allows a local unprivileged attacker to bypass security restrictions and execute privileged programs, potentially gaining root access. An attacker can exploit a race condition between mounting and applying security flags on filesystems authorized for user mounting.

Technologies: [Util-Linux](https://junglewise.ai/threats/technologies/util-linux-util-linux). Vendors: [Util-Linux](https://junglewise.ai/threats/vendors/util-linux).

## Quick answers

**Is CVE-2026-53614 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-53614 being exploited in the wild.

**How severe is CVE-2026-53614?** High severity, with a CVSS score of 7, published 14 October 2026.

**Which products and versions are affected?** Util-Linux 2.39.1 through 2.41.4, 2.42 through 2.42.1.

**Is there a fix for CVE-2026-53614?** Yes: fixed in 2.41.5, 2.42.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-53614 attacked?** It is attacked with local access.

**Am I affected by CVE-2026-53614?** Check whether you run Util-Linux at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 2.41.5, 2.42.2

## Technical details

The SUID `mount` utility in util-linux reads the attacker-controlled `LIBMOUNT_FORCE_MOUNT2` environment variable using `getenv()` without privilege-dropping, allowing a local user to force the legacy bind-mount code path. A time-of-check-time-of-use race condition exists between the initial bind mount and the subsequent remount that applies security flags (`nosuid`, `noexec`, `nodev`); an attacker can execute a SUID binary from the temporarily unprotected mount during this window, escalating privileges. The fix uses `safe_getenv()` to ignore the variable in SUID context and blocks multi-step mount sequences for non-root users in the legacy path.

## Affected products

- util-linux util-linux 2.39.1 through 2.41.4, 2.42 through 2.42.1

## Timeline

- 2026-10-14: disclosed
- 2026-10-14: patched

## References

- [https://github.com/util-linux/util-linux/commit/31e37c1c7dcf25b76ccf41391fe934a75644c661](https://github.com/util-linux/util-linux/commit/31e37c1c7dcf25b76ccf41391fe934a75644c661)
- [https://github.com/util-linux/util-linux/commit/53ff0fcdab12d69c60c971c69a3d0d173fa46ca9](https://github.com/util-linux/util-linux/commit/53ff0fcdab12d69c60c971c69a3d0d173fa46ca9)

## Related threats

- [util-linux integer overflow in DOS partition parsing](https://junglewise.ai/threats/cve-2026-53615-util-linux-is-a-random-collection-of-linux-utilities-before-util)
- [util-linux mount TOCTOU privilege escalation via renameat2](https://junglewise.ai/threats/cve-2026-53613-util-linux-is-a-random-collection-of-linux-utilities-in-util)