util-linux libmount Privilege Escalation via Failed Mount Helper
Priority HIGH 72CWE-390Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat.
Summary
util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00216 12th percentileScored 2026-11-07
Fix Fixed util-linux (util-linux): 2.41.6, 2.42.3Red Hat: 3 advisories
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| util-linux | util-linux | 2.39 to before 2.41.6; 2.42 to before 2.42.3 | 2.41.6, 2.42.3 | Patch available | CNA |
- util-linux Vendorutil-linux Affected 2.39 to before 2.41.6; 2.42 to before 2.42.3 Fixed in 2.41.6, 2.42.3 Patch available CNA
Remediation
- Fix · CNA util-linux (util-linux) Fixed in 2.41.6, 2.42.3
Red Hat 3 advisories
- RHSA-2026:95365 Released 2026-11-04 · Red Hat rating CriticalRed Hat Cost Management On-Premise container image update
- Red Hat Cost Management On-Premise 1 registry.redhat.io/costmanagement/costmanagement-ui-rhel10
- RHSA-2026:93461 Released 2026-11-02 · Red Hat rating Importantutil-linux security update
- Red Hat Enterprise Linux AppStream (v. 10) libblkid-devel-2.40.2-18.el10_2.20, libmount-devel-2.40.2-18.el10_2.20, libuuid-devel-2.40.2-18.el10_2.20 +2
- Red Hat Enterprise Linux BaseOS (v. 10) libblkid-2.40.2-18.el10_2.20, libfdisk-2.40.2-18.el10_2.20, libmount-2.40.2-18.el10_2.20 +4
- Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) libfdisk-devel-2.40.2-18.el10_2.20, libsmartcols-devel-2.40.2-18.el10_2.20
- RHSA-2026:63162 Released 2026-09-03 · Red Hat rating ImportantRed Hat Hardened Images RPMs Security Update
- Red Hat Hardened Images libblkid-2.42.2-3.4.hum1@aarch64, libblkid-2.42.2-3.4.hum1@x86_64, libblkid-devel-2.42.2-3.4.hum1@aarch64 +34
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Cost Management On-Premise 1 | Fixed | RHSA-2026:95365 |
| Red Hat Enterprise Linux AppStream (v. 10) | Fixed | RHSA-2026:93461 |
| Red Hat Enterprise Linux BaseOS (v. 10) | Fixed | RHSA-2026:93461 |
| Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) | Fixed | RHSA-2026:93461 |
| Red Hat Hardened Images | Fixed | RHSA-2026:63162 |
Not affected: 5 products
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift Container Platform 5
Timeline
- 2026-10-02 Threatist record created from CVE-2026-76642
- 2026-10-30 Affected versions changed · Red Hat
- 2026-11-02 Fix available: RHSA-2026:93461 · Red Hat
- 2026-11-02 Fix available: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) · Red Hat
- 2026-11-05 Fix available: Red Hat Cost Management On-Premise 1 · Red Hat
- 2026-11-06 Fix available: RHSA-2026:95365 · Red Hat
References
More util-linux vulnerabilities
- TI-2026-73994 Race condition in util-linux mount hook allows privilege escalation CVSS 3.1HIGH 7.0
- TI-2026-74163 Integer overflow in util-linux libblkid DOS extended partition parsing CVSS 3.1HIGH 8.0
- TI-2026-73996 util-linux LIBMOUNT_FORCE_MOUNT2 allows nosuid and noexec bypass CVSS 3.1HIGH 7.0
- TI-2026-73995 Race condition in util-linux mount lets local users gain root CVSS 3.1HIGH 7.0
- TI-2025-12886 Util-linux: util-linux: heap buffer overread in setpwnam() when processing 256-byte usernames CVSS 3.1MEDIUM 6.1
Sources
- CVE-2026-76642 · CVE Program
- CVE-2026-76642 · NVD
- FIRST EPSS
- CVE-2026-76642 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences