REDHAT-BUG-2522607: High severity util-linux mount vulnerability

Q: Which systems are exposed to exploitation by an unprivileged user?

Exploitation requires util-linux v2.42 through v2.42.2 or current master running on Linux 6.15 or later. The user must be able to use an fstab-authorized mount entry containing X-mount.subdir=.

Q: What access and filesystem conditions does an attacker need?

The attacker needs control over the configured subdirectory resolution path so that an intermediate symlink can point outside the newly mounted filesystem. Examples described include a symlink toward /etc or use of procfs self/root, allowing a host path to be attached at the fstab mountpoint.

Q: How can I determine whether an installation is affected?

Check whether the installed util-linux version is in v2.42 through v2.42.2 or is built from current master, whether the kernel is Linux 6.15 or later, and whether fstab entries authorize X-mount.subdir=. The vulnerable detached-tree path is gated on Linux 6.15 and later.

Published Aug 24, 2026

Updated

libmount's X-mount.subdir option on Linux >= 6.15 uses a detached-tree fast path (hooksubdir.c / hookmount.c). The configured subdirectory string is passed to opentree() with ATSYMLINKNOFOLLOW, but that flag does not block intermediate-component symlinks and does not provide RESOLVEBENEATH-style containment. An unprivileged user with an fstab-authorized X-mount.subdir= entry can therefore resolve outside the newly mounted filesystem (for example via an intermediate symlink to /etc, or via procfs self/root) and attach a host path at the fstab mountpoint. Restricted-user SUID mount(8) reproduction requires Linux >= 6.15; current HEAD gates that detached path on that kernel version. Introduced by ae19f7546ccb (2025-04-15); first released in util-linux v2.42. Affects v2.42 through v2.42.2 and current master. No upstream fix as of 2026-08-24. Reported upstream by Alex0Young. GHSA-8f2p-47x3-43mv.

Affected Software

2 affected components

util-linux mount>=2.42<=2.42.2

mount=master

Event History

Aug 24, 2026

Data Sourced

via Red Hat·06:38 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which systems are exposed to exploitation by an unprivileged user?

Exploitation requires util-linux v2.42 through v2.42.2 or current master running on Linux 6.15 or later. The user must be able to use an fstab-authorized mount entry containing X-mount.subdir=.

What access and filesystem conditions does an attacker need?

The attacker needs control over the configured subdirectory resolution path so that an intermediate symlink can point outside the newly mounted filesystem. Examples described include a symlink toward /etc or use of procfs self/root, allowing a host path to be attached at the fstab mountpoint.

How can I determine whether an installation is affected?

Check whether the installed util-linux version is in v2.42 through v2.42.2 or is built from current master, whether the kernel is Linux 6.15 or later, and whether fstab entries authorize X-mount.subdir=. The vulnerable detached-tree path is gated on Linux 6.15 and later.