Red Hat Security Advisory

RHSA-2026:93461

util-linux security update

Released 2026-11-02 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 10) libblkid-devel-2.40.2-18.el10_2.20, libmount-devel-2.40.2-18.el10_2.20, libuuid-devel-2.40.2-18.el10_2.20 +2
Red Hat Enterprise Linux BaseOS (v. 10) libblkid-2.40.2-18.el10_2.20, libfdisk-2.40.2-18.el10_2.20, libmount-2.40.2-18.el10_2.20 +4
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) libfdisk-devel-2.40.2-18.el10_2.20, libsmartcols-devel-2.40.2-18.el10_2.20

Fixes 9 records

TI-2026-53553 CVE-2026-76642

util-linux libmount Privilege Escalation via Failed Mount Helper

HIGH 72

util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems.

CVSS 4.0HIGH 8.5 Local Low privileges No interaction EPSS 0.00216 Published 2026-09-03 Fixed in 2.41.6, 2.42.3 CWE-390

TI-2026-54523 CVE-2026-78410

Util-linux: util-linux: restricted bind mounts do not pin the source, allowing x-mount.owner/group/mode redirection

HIGH 69

A flaw was found in util-linux.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00198 Published 2026-09-02 Fixed in 2.40.2-18.el10_2.20, 1793825318 +1 CWE-367

TI-2026-54521 CVE-2026-78408

Util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority

HIGH 68

The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve().

CVSS 3.1HIGH 7.9 Local Low privileges User interaction EPSS 0.00237 Published 2026-09-02 Fixed in 2.40.2-18.el10_2.20, 1793825318 +1 CWE-775

TI-2026-73994 CVE-2026-53612