Is CVE-2026-88838 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-88838 being exploited in the wild.

How severe is CVE-2026-88838?

Medium severity, with a CVSS score of 5.5, published 13 October 2026.

Which products and versions are affected?

BusyBox versions with setuid mount and user-mountable fstab entries.

How is CVE-2026-88838 attacked?

It is attacked with local access, in a network appliance.

Am I affected by CVE-2026-88838?

Check whether you run BusyBox at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-88838: BusyBox mount security restriction bypass in mount utility

CVE-2026-88838 · Severity: medium · CVSS 5.5 · Published 2026-10-13

BusyBox is a lightweight Unix utility suite commonly embedded in Linux systems and appliances. A flaw in its mount utility allows a non-root user to bypass filesystem security restrictions (like no-setuid, no-devices, no-execute) that administrators configure in /etc/fstab, potentially enabling privilege escalation or execution of malicious code. The vulnerability requires BusyBox mount to be installed with special permissions and user-mountable entries in fstab, which is not the default configuration in most distributions.

Technologies: BusyBox.

Quick answers

Is CVE-2026-88838 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-88838 being exploited in the wild.
How severe is CVE-2026-88838?: Medium severity, with a CVSS score of 5.5, published 13 October 2026.
Which products and versions are affected?: BusyBox versions with setuid mount and user-mountable fstab entries.
Is there a fix for CVE-2026-88838?: No fixed version is recorded yet. Do not install BusyBox mount setuid root on systems with user-mountable fstab entries using nosuid, nodev, or noexec restrictions. Remove user/users from sensitive fstab lines, or use util-linux mount instead.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-13"}] If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-88838 attacked?: It is attacked with local access, in a network appliance.
Am I affected by CVE-2026-88838?: Check whether you run BusyBox at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Do not install BusyBox mount setuid root on systems with user-mountable fstab entries using nosuid, nodev, or noexec restrictions. Remove user/users from sensitive fstab lines, or use util-linux mount instead.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-13"}]

Technical details

The vulnerability exists in BusyBox's mount utility when handling command-line options combined with fstab entries. A non-root attacker can pass clearing-mask options that bypass the non-root option filter, then are merged and re-parsed with fstab options as strings; during re-parsing, these clearing options can override nosuid, nodev, and noexec protections. Exploitation requires setuid-root installation of BusyBox mount, user-mountable fstab entries, and attacker-controlled filesystem content for post-exploitation (e.g., setuid binaries). A fix exists; alternate tools like util-linux mount are not vulnerable.

Affected products

BusyBox versions with setuid mount and user-mountable fstab entries

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.