CVE-2026-53612: util-linux mount hook_owner TOCTOU allows local privilege escalation

Local Privilege Escalation via TOCTOU in mount(8) hookowner.c chmod/chown

— Debian

util-linux is a random collection of Linux utilities. In util-linux 2.39 through 2.41.4 and 2.42 through 2.42.1, the SUID mount utility's hookowner.c post-mount hook performs path-based chmod() and lchown() operations on a previously validated mount target. A local low-privileged user authorized by an /etc/fstab entry with user or users and an X-mount.mode, X-mount.owner, or X-mount.group option can use renameat2(RENAMEEXCHANGE) to race a writable ancestor of the target and redirect the privileged ownership or mode change to a root-owned path, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2.

— MITRE

util-linux mount hookowner TOCTOU allows local privilege escalation

— Microsoft