Affected: Alpaquita:25: util-linux, Alpaquita:stream: util-linux, BellSoft Hardened Containers:25: util-linux, BellSoft Hardened Containers:stream: util-linux

A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.

Affected: openEuler:20.03-LTS-SP4: util-linux

The util-linux package contains a random collection of files that implements some low-level basic linux utilities. Security Fix(es):

When an /etc/fstab entry is configured with the user or users option, mount(8) validates the target path before performing the mount syscall, creating a Time-of-Check-Time-of-Use (TOCTOU) window. A local unprivileged user with write access to an ancestor directory of the mount target can swap that directory to redirect the mount to an arbitrary root-owned location, potentially escalating privileges to root.(CVE-2026-53613)

A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.(CVE-2026-78410)

libblkid-devel-2.42.3-1.1 on GA media

util-linux: util-linux: failed external mount helper still runs privileged X-mount post-hooks util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority util-linux: util-linux: X-mount.subdir detached-tree resolution can escape via intermediate symlinks util-linux: util-linux: restricted bind mounts do not pin the source, allowing X-mount.owner/group/mode redirection

Security update for util-linux

Affected: Ubuntu:14.04:LTS: util-linux, Ubuntu:Pro:16.04:LTS: util-linux, Ubuntu:18.04:LTS: util-linux, Ubuntu:Pro:20.04:LTS: util-linux, Ubuntu:22.04:LTS: util-linux, Ubuntu:24.04:LTS: util-linux, Ubuntu:26.04:LTS: util-linux

A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.