util-linux is a random collection of Linux utilities. Before util-linux 2.41.4, parsedosextended() in libblkid/src/partitions/dos.c computes an extended-partition start sector with 32-bit addition and does not apply the extended-area bounds checks to the first two EBR entries. A local attacker who causes a crafted DOS extended-partition disk image or removable medium to be probed can wrap curstart + start to sector zero and cause libblkid to report a false partition overlapping the MBR. This directly compromises the integrity of the reported partition metadata; disk modification or availability loss requires a separate downstream consumer to act on that metadata. This issue is fixed in 2.41.4.

util-linux is a random collection of Linux utilities. In util-linux 2.39.1 through 2.41.4 and 2.42 through 2.42.1, the SUID mount utility reads the attacker-controlled LIBMOUNTFORCEMOUNT2 environment variable with getenv(), allowing a local low-privileged user to force the non-atomic legacy bind-mount path. With an /etc/fstab bind mount authorized by user or users and protected by nosuid, noexec, or nodev, an attacker can race the window between the initial bind mount and the remount that applies those security flags and execute a SUID program from the temporarily unprotected mount, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2.

util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy mount(2) path is used without /proc, restricted non-root mount requests validate an /etc/fstab target before the mount operation re-resolves that pathname. A local low-privileged user authorized by an fstab user or users entry whose target has an attacker-writable ancestor can use renameat2(RENAMEEXCHANGE) to swap a path component and redirect an authorized mount to a root-owned location, such as mounting attacker-controlled content over /etc/sudoers.d, and thereby gain root privileges. Versions 2.41.5 and 2.42.2 pin targets for the new mount API, and 2.42.4 pins legacy targets through /proc/self/fd; the documented legacy fallback without /proc remains affected.

util-linux is a random collection of Linux utilities. In util-linux 2.39 through 2.41.4 and 2.42 through 2.42.1, the SUID mount utility's hookowner.c post-mount hook performs path-based chmod() and lchown() operations on a previously validated mount target. A local low-privileged user authorized by an /etc/fstab entry with user or users and an X-mount.mode, X-mount.owner, or X-mount.group option can use renameat2(RENAMEEXCHANGE) to race a writable ancestor of the target and redirect the privileged ownership or mode change to a root-owned path, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2.

Hi,

On Fri, Sep 04, 2026 at 06:38:13PM +0100, Sam James wrote: +util-linux 2.42.3 Release Notes +=============================== + +Security fixes: [...] + CVE-2026-78408 - nsenter(1), unshare(1) file descriptor leak. + File descriptors in nsenter and unshare were not created with + OCLOEXEC, potentially leaking them across exec. Added OCLOEXEC + as defense in depth. Note this needs a followup fix in the stable branches: https://github.com/util-linux/util-linux/commit/286dd3ff41526b582ef48830de239dffbaa61f90

Regards, Salvatore

A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.

libmount's X-mount.subdir option on Linux >= 6.15 uses a detached-tree fast path (hooksubdir.c / hookmount.c). The configured subdirectory string is passed to opentree() with ATSYMLINKNOFOLLOW, but that flag does not block intermediate-component symlinks and does not provide RESOLVEBENEATH-style containment. An unprivileged user with an fstab-authorized X-mount.subdir= entry can therefore resolve outside the newly mounted filesystem (for example via an intermediate symlink to /etc, or via procfs self/root) and attach a host path at the fstab mountpoint. Restricted-user SUID mount(8) reproduction requires Linux >= 6.15; current HEAD gates that detached path on that kernel version. Introduced by ae19f7546ccb (2025-04-15); first released in util-linux v2.42. Affects v2.42 through v2.42.2 and current master. No upstream fix as of 2026-08-24. Reported upstream by Alex0Young. GHSA-8f2p-47x3-43mv.

A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.

util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither ONOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.

A flaw was found in util-linux. Improper hostname canonicalization in the login(1) utility, when invoked with the -h option, can modify the supplied remote hostname before setting PAMRHOST. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.

A flaw was found in util-linux. Heap buffer overread when processing 256-byte usernames. Affects any SUID login-utils utility writing to password database. The setpwnam() function allocates a 256-byte buffer but accesses linebuf[256] when username length equals 256, causing a heap buffer overread.

A flaw was found in util-linux. Heap buffer overread when processing 256-byte usernames. Affects any SUID login-utils utility writing to password database. The setpwnam() function allocates a 256-byte buffer but accesses linebuf[256] when username length equals 256, causing a heap buffer overread.

A system is running a version of software that was replaced with a Trojan Horse at one of its distribution points, such as (1) TCP Wrappers 7.6, (2) util-linux 2.9g, (3) wuarchive ftpd (wuftpd) 2.2 and 2.1f, (4) IRC client (ircII) ircII 2.2.9, (5) OpenSSH 3.4p1, or (6) Sendmail 8.12.6.