CVE-2026-76642: util-linux libmount Privilege Escalation via Failed Mount Helper
util-linux libmount Privilege Escalation via Failed Mount Helper
Other sources
util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.
— MITRE
When an external mount.<type> helper executes but exits nonzero, libmount records the helper's failure in helperstatus yet returns success from exechelper() in contextmount.c. mntcontextdomount() then runs privileged MNTSTAGEMOUNTPOST hooks as if the helper had mounted the requested filesystem. With an /etc/fstab entry usable by an unprivileged user that specifies X-mount.idmap, the idmap post-hook clones the pre-existing filesystem under the target (inheriting suid,exec from the underlying mount because helper-path VFS-flag application is skipped), enabling a local unprivileged user to obtain EUID 0. Independently, X-mount.owner/group/mode post-hooks can change ownership and mode of the physical target inode even when no mount was created. Exploitation requires SUID-root mount(8), a root-controlled fstab entry with the user option plus X-mount.idmap or X-mount.owner/group/mode, and an external helper that exits nonzero; the helper need not be malicious. This is distinct from CVE-2026-53612 (TOCTOU in hookowner.c): there is no race or path substitution. Affects util-linux v2.39 through current master (dynamically confirmed on 2.41-5, 2.42.2-2, and 0f119878). No upstream fix as of 2026-08-24. Reported upstream by 4drez and S0S4. GHSA-m25x-3hj9-m26f.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.40.2-6 - Upgrade
Upgrade
debian/util-linuxto a version that resolves this vulnerability.Fixed in 2.42.3-1 - Upgrade
Upgrade
debian/util-linuxto a version that resolves this vulnerability.Fixed in 2.38.1-5+deb12u3Fixed in 2.38.1-5+deb12u1Fixed in 2.42.4-1
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
An attacker needs local access as an unprivileged user. The vector indicates low attack complexity, low privileges required, and no user interaction.
Which configurations are exposed?
Exposure requires use of libmount with mount helpers and post-mount hooks such as X-mount.idmap or X-mount.owner. The provided data does not establish that a default configuration enables these conditions.
What is the likely impact after successful exploitation?
An attacker may perform privileged operations on pre-existing filesystems, including cloning filesystems while inheriting suid bits or changing target inode permissions. This can result in local privilege escalation with high confidentiality, integrity, and availability impact.
How can I determine whether a system is affected?
Check whether the installed util-linux version is through 2.41.5 or through 2.42.2, and whether libmount is used with mount helpers and X-mount.idmap or X-mount.owner hooks. The supplied information does not provide a more specific detection method or a fixed-version range.