Restricted-user bind/rbind mounts authorize the source from /etc/fstab but do not pin that source inode before the privileged mount. libmount later opens the source as a pathname via opentree(ATFDCWD, source, OPENTREECLONE|...) (mntcontextopentree in context.c / hookmount.c). A local unprivileged user who can replace the fstab bind source or a writable ancestor with a symlink can redirect SUID mount(8) to bind an attacker-selected host directory. When the same fstab entry includes X-mount.owner=, X-mount.group=, or X-mount.mode=, hookowner.c then applies root-privileged fchownat()/chmod() to the mounted root, which for a bind mount is the redirected source inode. This is a source-side pathname TOCTOU; current HEAD already pins the target and uses fd-based owner hooks (the CVE-2026-53612 target-path fix), but that fd now refers to the attacker-redirected bind source. Distinct from the public loop backing-file TOCTOU and from CVE-2026-76642 (failed external helper still running post-hooks). X-mount.owner/group/mode was introduced with v2.39; no upstream fix as of 2026-08-24. Reported upstream by Alex0Young. GHSA-rh77-686x-2f2m.

libmount's X-mount.subdir option on Linux >= 6.15 uses a detached-tree fast path (hooksubdir.c / hookmount.c). The configured subdirectory string is passed to opentree() with ATSYMLINKNOFOLLOW, but that flag does not block intermediate-component symlinks and does not provide RESOLVEBENEATH-style containment. An unprivileged user with an fstab-authorized X-mount.subdir= entry can therefore resolve outside the newly mounted filesystem (for example via an intermediate symlink to /etc, or via procfs self/root) and attach a host path at the fstab mountpoint. Restricted-user SUID mount(8) reproduction requires Linux >= 6.15; current HEAD gates that detached path on that kernel version. Introduced by ae19f7546ccb (2025-04-15); first released in util-linux v2.42. Affects v2.42 through v2.42.2 and current master. No upstream fix as of 2026-08-24. Reported upstream by Alex0Young. GHSA-8f2p-47x3-43mv.