CVE-2026-76642: util-linux libmount Privilege Escalation via Failed Mount Helper
util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
util-linux libmountto a version that resolves this vulnerability.Fixed in 2.42.2 - Upgrade
Upgrade
util-linux libmountto a version that resolves this vulnerability.Fixed in 2.41.5
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
An attacker needs local access as an unprivileged user. The vector indicates low attack complexity, low privileges required, and no user interaction.
Which configurations are exposed?
Exposure requires use of libmount with mount helpers and post-mount hooks such as X-mount.idmap or X-mount.owner. The provided data does not establish that a default configuration enables these conditions.
What is the likely impact after successful exploitation?
An attacker may perform privileged operations on pre-existing filesystems, including cloning filesystems while inheriting suid bits or changing target inode permissions. This can result in local privilege escalation with high confidentiality, integrity, and availability impact.
How can I determine whether a system is affected?
Check whether the installed util-linux version is through 2.41.5 or through 2.42.2, and whether libmount is used with mount helpers and X-mount.idmap or X-mount.owner hooks. The supplied information does not provide a more specific detection method or a fixed-version range.