CVE-2026-53613: util-linux mount target TOCTOU allows local privilege escalation
A race condition vulnerability exists in util-linux's SUID mount binary /usr/bin/mount. The fstab validation and permission checks for the mount target occur before the actual mount syscall executes. A local unprivileged attacker can exploit this window using renameat2(RENAMEEXCHANGE) (or equivalent ancestor directory swaps) to redirect the intended target path to an arbitrary root-owned location, such as /etc/sudoers.d, causing SUID mount(8) to mount there instead. Exploitation requires an /etc/fstab entry with the user or users option where an ancestor directory of the mount target is writable by the attacker. Affects util-linux v2.17 through v2.43-devel (unfixed as of the June 16, 2026 advisory). Reported upstream by Xinyao Hu. GHSA-8gj5-72r3-428g.
Other sources
util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy mount(2) path is used without /proc, restricted non-root mount requests validate an /etc/fstab target before the mount operation re-resolves that pathname. A local low-privileged user authorized by an fstab user or users entry whose target has an attacker-writable ancestor can use renameat2(RENAMEEXCHANGE) to swap a path component and redirect an authorized mount to a root-owned location, such as mounting attacker-controlled content over /etc/sudoers.d, and thereby gain root privileges. Versions 2.41.5 and 2.42.2 pin targets for the new mount API, and 2.42.4 pins legacy targets through /proc/self/fd; the documented legacy fallback without /proc remains affected.
— MITRE
util-linux mount target TOCTOU allows local privilege escalation
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/util-linuxto a version that resolves this vulnerability.Fixed in 2.37.2-4ubuntu3.6 - Upgrade
Upgrade
ubuntu/util-linuxto a version that resolves this vulnerability.Fixed in 2.39.3-9ubuntu6.6 - Upgrade
Upgrade
ubuntu/util-linuxto a version that resolves this vulnerability.Fixed in 2.41.3-3ubuntu2.2 - Upgrade
Upgrade
debian/util-linuxto a version that resolves this vulnerability.Fixed in 2.41.5-0+deb13u1Fixed in 2.42.4-1 - Upgrade
Upgrade
azurelinux/util-linuxto a version that resolves this vulnerability.Fixed in 2.40.2-7