CVE-2026-53612 util-linux CVE debrief

Who should care

System administrators and users with local access to systems running util-linux versions 2.39 through 2.41.4 or 2.42 through 2.42.1 should assess their exposure and apply patches or updates as necessary.

Why it matters

A local low-privileged user can exploit a TOCTOU vulnerability in the util-linux mount utility to potentially gain root privileges. The issue is fixed in versions 2.41.5 and 2.42.2.

• Local privilege escalation is possible for low-privileged users
• Systems with /etc/fstab entries allowing user or users access are vulnerable
• Applying patches or updates to util-linux versions 2.41.5 or 2.42.2 is necessary to fix the issue

Technical summary

The SUID `mount` utility's `hook_owner.c` post-mount hook performs path-based `chmod()` and `lchown()` operations on a previously validated mount target. A local low-privileged user authorized by an `/etc/fstab` entry with `user` or `users` and an `X-mount.mode`, `X-mount.owner`, or `X-mount.group` option can use `renameat2(RENAME_EXCHANGE)` to race a writable ancestor of the target and redirect the privileged ownership or mode change to a root-owned path.

Defensive priority

High

Recommended defensive actions

• Assess exposure by identifying systems with util-linux versions 2.39 through 2.41.4 or 2.42 through 2.42.1
• Verify if the /etc/fstab entry with 'user' or 'users' and an 'X-mount.mode', 'X-mount.owner', or 'X-mount.group' option is present
• Apply patches or updates to util-linux versions 2.41.5 or 2.42.2
• Monitor for suspicious activity related to the mount utility
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, affected versions, and fixed versions. The vulnerability is caused by a TOCTOU (time-of-check to time-of-use) issue in the util-linux mount utility. The issue is fixed in versions 2.41.5 and 2.42.2. There is no public exploit available, but the vulnerability is considered high severity due to the potential for local privilege escalation. The CVE record and source item provide details on the vulnerability, including its description, affected

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.