ALSA-2026:93461: Important: util-linux security update

Q: Which systems and workflows are most relevant to the mount-related issues?

Systems that use the mount program, especially SUID mount(8), loop-device setup, external mount helpers, restricted bind mounts, or post-mount ownership and mode changes are relevant to several of the listed fixes. The advisory also lists issues involving nsenter cgroup joining and libblkid partition probing.

Q: Are fixed package versions provided in this advisory data?

No. The provided data identifies affected AlmaLinux components but does not include fixed versions, package release numbers, or update instructions.

Q: What package components are explicitly listed as affected?

The listed components are libblkid, libblkid-devel, libfdisk, libfdisk-devel, libmount, libmount-devel, libsmartcols, and libsmartcols-devel for AlmaLinux.

Published Nov 2, 2026

Updated

The util-linux packages contain a large variety of low-level system utilities that are necessary for a Linux system to function. Among others, these include the fdisk configuration tool and the login program.

Security Fix(es):

util-linux: TOCTOU in the mount program when setting up loop devices (CVE-2026-27456) util-linux: util-linux: heap use-after-free in libblkid nested partition probing (CVE-2026-13595) util-linux: TOCTOU in the mount program via ancestor directory swap on target path (CVE-2026-53613) util-linux: util-linux: TOCTOU in the mount program when applying post-mount ownership/mode changes (CVE-2026-53612) util-linux: util-linux: SUID mount(8) allows nosuid/noexec bypass via LIBMOUNTFORCEMOUNT2 (CVE-2026-53614) util-linux: util-linux: failed external mount helper still runs privileged X-mount post-hooks (CVE-2026-76642) util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority (CVE-2026-78408) util-linux: util-linux: restricted bind mounts do not pin the source, allowing X-mount.owner/group/mode redirection (CVE-2026-78410) util-linux: util-linux: Partition metadata compromise via integer overflow in DOS partition parser (CVE-2026-53615)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected Software

14 affected componentsFixes available

almalinux/libblkid<2.40.2-18.el10_2.20

2.40.2-18.el10_2.20

almalinux/libblkid-devel<2.40.2-18.el10_2.20

2.40.2-18.el10_2.20

almalinux/libfdisk<2.40.2-18.el10_2.20

2.40.2-18.el10_2.20

almalinux/libfdisk-devel<2.40.2-18.el10_2.20

2.40.2-18.el10_2.20

almalinux/libmount<2.40.2-18.el10_2.20

2.40.2-18.el10_2.20

almalinux/libmount-devel<2.40.2-18.el10_2.20

2.40.2-18.el10_2.20

almalinux/libsmartcols<2.40.2-18.el10_2.20

2.40.2-18.el10_2.20

almalinux/libsmartcols-devel<2.40.2-18.el10_2.20

2.40.2-18.el10_2.20

almalinux/libuuid<2.40.2-18.el10_2.20

2.40.2-18.el10_2.20

almalinux/libuuid-devel<2.40.2-18.el10_2.20

2.40.2-18.el10_2.20

almalinux/python3-libmount<2.40.2-18.el10_2.20

2.40.2-18.el10_2.20

almalinux/util-linux<2.40.2-18.el10_2.20

2.40.2-18.el10_2.20

almalinux/util-linux-core<2.40.2-18.el10_2.20

2.40.2-18.el10_2.20

almalinux/uuidd<2.40.2-18.el10_2.20

2.40.2-18.el10_2.20

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade almalinux/libblkid to a version that resolves this vulnerability.
Fixed in 2.40.2-18.el10_2.20
Upgrade
Upgrade almalinux/libblkid-devel to a version that resolves this vulnerability.
Fixed in 2.40.2-18.el10_2.20
Upgrade
Upgrade almalinux/libfdisk to a version that resolves this vulnerability.
Fixed in 2.40.2-18.el10_2.20
Upgrade
Upgrade almalinux/libfdisk-devel to a version that resolves this vulnerability.
Fixed in 2.40.2-18.el10_2.20
Upgrade
Upgrade almalinux/libmount to a version that resolves this vulnerability.
Fixed in 2.40.2-18.el10_2.20
Upgrade
Upgrade almalinux/libmount-devel to a version that resolves this vulnerability.
Fixed in 2.40.2-18.el10_2.20
Upgrade
Upgrade almalinux/libsmartcols to a version that resolves this vulnerability.
Fixed in 2.40.2-18.el10_2.20
Upgrade
Upgrade almalinux/libsmartcols-devel to a version that resolves this vulnerability.
Fixed in 2.40.2-18.el10_2.20
Upgrade
Upgrade almalinux/libuuid to a version that resolves this vulnerability.
Fixed in 2.40.2-18.el10_2.20
Upgrade
Upgrade almalinux/libuuid-devel to a version that resolves this vulnerability.
Fixed in 2.40.2-18.el10_2.20
Upgrade
Upgrade almalinux/python3-libmount to a version that resolves this vulnerability.
Fixed in 2.40.2-18.el10_2.20
Upgrade
Upgrade almalinux/util-linux to a version that resolves this vulnerability.
Fixed in 2.40.2-18.el10_2.20
Upgrade
Upgrade almalinux/util-linux-core to a version that resolves this vulnerability.
Fixed in 2.40.2-18.el10_2.20
Upgrade
Upgrade almalinux/uuidd to a version that resolves this vulnerability.
Fixed in 2.40.2-18.el10_2.20

Event History

Nov 2, 2026

Advisory Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

Which systems and workflows are most relevant to the mount-related issues?

Systems that use the mount program, especially SUID mount(8), loop-device setup, external mount helpers, restricted bind mounts, or post-mount ownership and mode changes are relevant to several of the listed fixes. The advisory also lists issues involving nsenter cgroup joining and libblkid partition probing.

Are fixed package versions provided in this advisory data?

No. The provided data identifies affected AlmaLinux components but does not include fixed versions, package release numbers, or update instructions.

What package components are explicitly listed as affected?

The listed components are libblkid, libblkid-devel, libfdisk, libfdisk-devel, libmount, libmount-devel, libsmartcols, and libsmartcols-devel for AlmaLinux.

ALSA-2026:93461: Important: util-linux security update

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which systems and workflows are most relevant to the mount-related issues?

Are fixed package versions provided in this advisory data?

What package components are explicitly listed as affected?

Company

Resources

Contact

Frequently Asked Questions

Which systems and workflows are most relevant to the mount-related issues?

Are fixed package versions provided in this advisory data?

What package components are explicitly listed as affected?