Executive brief
util-linux is a core Linux system utility package that handles filesystem mounting operations. A flaw allows unprivileged users to bypass mount helper validation, enabling them to execute privileged operations on existing filesystems through post-mount hooks. Attackers can gain unauthorized access, modify permissions, or escalate privileges on shared systems.
Technical details
The vulnerability exists in libmount's context_mount.c where the mount helper exit status is not properly validated before executing post-mount hooks (X-mount.idmap and X-mount.owner). An unprivileged attacker can trigger a mount helper failure and exploit the subsequent hooks to clone filesystems with inherited SUID bits or modify inode permissions without proper authorization. The attack requires local access to mount-capable functions but no special privileges to trigger. Patches addressing exit status validation have been committed to util-linux repositories.
Affected products
- util-linux util-linux through 2.41.5 and 2.42.2
Timeline
- 2026-09-03: disclosed