CVE-2026-88838: Busybox: busybox: non-root mount option filter bypass allows clearing fstab security restrictions
A flaw was found in BusyBox's mount utility. A non-root user can bypass mount security restrictions set in /etc/fstab by specifying clearing-mask options on the command line. These options pass the non-root flag filter and are merged with fstab options as strings; when the combined options are re-parsed, clearing options can override nosuid, nodev, and noexec protections the administrator intended to enforce.
Other sources
A vulnerability exists in the BusyBox mount applet's non-root option filter in util-linux/mount.c. The filter uses cmdoptflags & ~MSSILENT to test for dangerous options, but clearing-mask options (suid, dev, exec) AND bits off rather than OR bits on, evaluating to zero and passing the check unconditionally. This allows a non-root user to strip nosuid, nodev, and noexec restrictions from fstab-defined user mounts.
The finding was reproduced only after artificially setting the setuid bit on BusyBox. Only the filter bypass was demonstrated, not actual privilege escalation.
— Red Hat
Busybox: busybox: non-root mount option filter bypass allows clearing fstab security restrictions
— Microsoft
Affected Software
Event History
Frequently Asked Questions
Which systems are realistically exposed to this issue?
Exposure requires the BusyBox mount applet to be usable by non-root users for fstab-defined mounts and to run with the privileges needed to perform those mounts. The reported reproduction required artificially setting the BusyBox setuid bit, so ordinary installations without such a configuration may not be affected in practice.
What does an attacker need to exploit the bypass?
An attacker needs a local non-root account that can invoke the BusyBox mount utility against an /etc/fstab entry permitting user mounts. They can supply clearing options such as suid, dev, or exec that remove corresponding nosuid, nodev, or noexec restrictions.
What is the demonstrated impact?
The demonstrated effect is removal of fstab-enforced nosuid, nodev, and noexec mount protections for a non-root user mount. The finding demonstrated the filter bypass only; actual privilege escalation was not demonstrated.
What can be done if patching is not immediately possible?
Avoid configurations that allow non-root users to invoke a privileged BusyBox mount applet for fstab-defined mounts. In particular, remove an unnecessary setuid bit from BusyBox and review user-mount fstab entries that rely on nosuid, nodev, or noexec restrictions.