Executive brief
util-linux is a core Linux utility suite that provides system administration tools, including the mount command for attaching filesystems. A flaw in restricted bind mount handling allows an unprivileged local user to redirect the SUID mount tool to bind directories other than intended, potentially gaining unauthorized access to sensitive files or allowing root to change ownership/permissions on attacker-controlled inodes, leading to privilege escalation.
Technical details
The vulnerability is a privilege escalation flaw in util-linux's handling of restricted bind mounts configured in fstab. The mount(8) SUID binary reads the source path from fstab but fails to pin (verify) the source inode before performing the privileged mount operation. A local unprivileged user can exploit this by replacing the authorized source path or a writable ancestor directory with a symlink or manipulated path, causing the SUID mount(8) to bind an unintended directory. If the fstab entry specifies X-mount.owner, X-mount.group, or X-mount.mode options, root will then change ownership or permissions on the redirected inode, granting the attacker control over arbitrary filesystem objects. Attack requires local access and the ability to manipulate the filesystem hierarchy; no authentication bypass is involved, but the race condition window and directory replacement capability are the core weaknesses.
Affected products
- util-linux util-linux
Timeline
- 2026-09-02: disclosed