https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 11:43:56 +0000 https://vulnerability.circl.lu/vuln/bell-cve-2026-78410 <p><strong>Affected:</strong> Alpaquita:25: util-linux, Alpaquita:stream: util-linux, BellSoft Hardened Containers:25: util-linux, BellSoft Hardened Containers:stream: util-linux</p> <p><strong>Affected:</strong> Alpaquita:25: util-linux, Alpaquita:stream: util-linux, BellSoft Hardened Containers:25: util-linux, BellSoft Hardened Containers:stream: util-linux</p> https://vulnerability.circl.lu/vuln/bell-cve-2026-78410 https://vulnerability.circl.lu/vuln/fkie_cve-2026-78410 <p>A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.</p> <p>A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-78410 https://vulnerability.circl.lu/vuln/msrc_cve-2026-78410 msrc_CVE-2026-78410 https://vulnerability.circl.lu/vuln/msrc_cve-2026-78410 https://vulnerability.circl.lu/vuln/oesa-2026-3978 <p><strong>Affected:</strong> openEuler:20.03-LTS-SP4: util-linux</p> <p>The util-linux package contains a random collection of files that implements some low-level basic linux utilities. Security Fix(es):</p> <p>When an /etc/fstab entry is configured with the user or users option, mount(8) validates the target path before performing the mount syscall, creating a Time-of-Check-Time-of-Use (TOCTOU) window. A local unprivileged user with write access to an ancestor directory of the mount target can swap that directory to redirect the mount to an arbitrary root-owned location, potentially escalating privileges to root.(CVE-2026-53613)</p> <p>A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.(CVE-2026-78410)</p> <p><strong>Affected:</strong> openEuler:20.03-LTS-SP4: util-linux</p> <p>The util-linux package contains a random collection of files that implements some low-level basic linux utilities. Security Fix(es):</p> <p>When an /etc/fstab entry is configured with the user or users option, mount(8) validates the target path before performing the mount syscall, creating a Time-of-Check-Time-of-Use (TOCTOU) window. A local unprivileged user with write access to an ancestor directory of the mount target can swap that directory to redirect the mount to an arbitrary root-owned location, potentially escalating privileges to root.(CVE-2026-53613)</p> <p>A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.(CVE-2026-78410)</p> https://vulnerability.circl.lu/vuln/oesa-2026-3978 https://vulnerability.circl.lu/vuln/opensuse-su-2026:11870-1 <p>libblkid-devel-2.42.3-1.1 on GA media</p> <p>libblkid-devel-2.42.3-1.1 on GA media</p> https://vulnerability.circl.lu/vuln/opensuse-su-2026:11870-1 https://vulnerability.circl.lu/vuln/rhsa-2026:63162 <p>util-linux: util-linux: failed external mount helper still runs privileged X-mount post-hooks util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority util-linux: util-linux: X-mount.subdir detached-tree resolution can escape via intermediate symlinks util-linux: util-linux: restricted bind mounts do not pin the source, allowing X-mount.owner/group/mode redirection</p> <p>util-linux: util-linux: failed external mount helper still runs privileged X-mount post-hooks util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority util-linux: util-linux: X-mount.subdir detached-tree resolution can escape via intermediate symlinks util-linux: util-linux: restricted bind mounts do not pin the source, allowing X-mount.owner/group/mode redirection</p> https://vulnerability.circl.lu/vuln/rhsa-2026:63162 https://vulnerability.circl.lu/vuln/suse-su-2026:23861-1 <p>Security update for util-linux</p> <p>Security update for util-linux</p> https://vulnerability.circl.lu/vuln/suse-su-2026:23861-1 https://vulnerability.circl.lu/vuln/ubuntu-cve-2026-78410 <p><strong>Affected:</strong> Ubuntu:14.04:LTS: util-linux, Ubuntu:Pro:16.04:LTS: util-linux, Ubuntu:18.04:LTS: util-linux, Ubuntu:Pro:20.04:LTS: util-linux, Ubuntu:22.04:LTS: util-linux, Ubuntu:24.04:LTS: util-linux, Ubuntu:26.04:LTS: util-linux</p> <p>A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.</p> <p><strong>Affected:</strong> Ubuntu:14.04:LTS: util-linux, Ubuntu:Pro:16.04:LTS: util-linux, Ubuntu:18.04:LTS: util-linux, Ubuntu:Pro:20.04:LTS: util-linux, Ubuntu:22.04:LTS: util-linux, Ubuntu:24.04:LTS: util-linux, Ubuntu:26.04:LTS: util-linux</p> <p>A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.</p> https://vulnerability.circl.lu/vuln/ubuntu-cve-2026-78410