# CVE-2026-88838: BusyBox mount security restriction bypass in mount utility

Source: https://junglewise.ai/threats/cve-2026-88838-a-flaw-was-found-in-busybox-s-mount-utility-a-non-root-user-can  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-13. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-88838 · Severity: medium · CVSS 5.5 · Published 2026-10-13

BusyBox is a lightweight Unix utility suite commonly embedded in Linux systems and appliances. A flaw in its mount utility allows a non-root user to bypass filesystem security restrictions (like no-setuid, no-devices, no-execute) that administrators configure in /etc/fstab, potentially enabling privilege escalation or execution of malicious code. The vulnerability requires BusyBox mount to be installed with special permissions and user-mountable entries in fstab, which is not the default configuration in most distributions.

Technologies: [BusyBox](https://junglewise.ai/threats/technologies/x-busybox).

## Quick answers

**Is CVE-2026-88838 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-88838 being exploited in the wild.

**How severe is CVE-2026-88838?** Medium severity, with a CVSS score of 5.5, published 13 October 2026.

**Which products and versions are affected?** BusyBox versions with setuid mount and user-mountable fstab entries.

**Is there a fix for CVE-2026-88838?** No fixed version is recorded yet. Do not install BusyBox mount setuid root on systems with user-mountable fstab entries using nosuid, nodev, or noexec restrictions. Remove user/users from sensitive fstab lines, or use util-linux mount instead.</anigation>
<parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-13"}] If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-88838 attacked?** It is attacked with local access, in a network appliance.

**Am I affected by CVE-2026-88838?** Check whether you run BusyBox at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Do not install BusyBox mount setuid root on systems with user-mountable fstab entries using nosuid, nodev, or noexec restrictions. Remove user/users from sensitive fstab lines, or use util-linux mount instead.</anigation>
<parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-13"}]

## Technical details

The vulnerability exists in BusyBox's mount utility when handling command-line options combined with fstab entries. A non-root attacker can pass clearing-mask options that bypass the non-root option filter, then are merged and re-parsed with fstab options as strings; during re-parsing, these clearing options can override nosuid, nodev, and noexec protections. Exploitation requires setuid-root installation of BusyBox mount, user-mountable fstab entries, and attacker-controlled filesystem content for post-exploitation (e.g., setuid binaries). A fix exists; alternate tools like util-linux mount are not vulnerable.

## Affected products

- BusyBox versions with setuid mount and user-mountable fstab entries

## References

- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://access.redhat.com/security/cve/CVE-2026-88838](https://access.redhat.com/security/cve/CVE-2026-88838)

## Related threats

- [BusyBox integer overflow in volume_id](https://junglewise.ai/threats/cve-2026-124746-a-flaw-was-found-in-busybox-an-integer-overflow-occurs-in-the)
- [BusyBox tar hardlink resolution path traversal](https://junglewise.ai/threats/cve-2026-124745-a-flaw-was-found-in-busybox-when-extracting-an-archive-the-tar)
- [BusyBox cpio hardlink path traversal vulnerability](https://junglewise.ai/threats/cve-2026-124744-a-flaw-was-found-in-busybox-when-extracting-files-using-the-cpio)
- [BusyBox divide-by-zero in HFS+ filesystem parsing](https://junglewise.ai/threats/cve-2026-124743-a-flaw-was-found-in-busybox-when-processing-filesystem-metadata)
- [BusyBox udhcpc6 use-after-free in DHCPv6 client](https://junglewise.ai/threats/cve-2026-124740-a-flaw-was-found-in-busybox-s-udhcpc6-dhcpv6-client-a-malicious)