{"id":"CVE-2026-53612","summary":"util-linux mount hook_owner TOCTOU allows local privilege escalation","details":"util-linux is a random collection of Linux utilities. In util-linux 2.39 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility's `hook_owner.c` post-mount hook performs path-based `chmod()` and `lchown()` operations on a previously validated mount target. A local low-privileged user authorized by an `/etc/fstab` entry with `user` or `users` and an `X-mount.mode`, `X-mount.owner`, or `X-mount.group` option can use `renameat2(RENAME_EXCHANGE)` to race a writable ancestor of the target and redirect the privileged ownership or mode change to a root-owned path, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2.","aliases":["GHSA-g8wm-75wr-g2vh"],"modified":"2026-10-24T07:14:13.318601141Z","published":"2026-10-14T14:47:25.523Z","related":["SUSE-SU-2026:23250-1","SUSE-SU-2026:23255-1","SUSE-SU-2026:23861-1","SUSE-SU-2026:23870-1","SUSE-SU-2026:23884-1","SUSE-SU-2026:3684-1","SUSE-SU-2026:3685-1","openSUSE-SU-2026:11408-1","openSUSE-SU-2026:21905-1"],"database_specific":{"cwe_ids":["CWE-367"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53612.json","cna_assigner":"GitHub_M"},"references":[{"type":"WEB","url":"https://github.com/util-linux/util-linux/releases/tag/v2.41.5"},{"type":"WEB","url":"https://github.com/util-linux/util-linux/releases/tag/v2.42.2"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53612.json"},{"type":"ADVISORY","url":"https://github.com/util-linux/util-linux/security/advisories/GHSA-g8wm-75wr-g2vh"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53612"},{"type":"FIX","url":"https://github.com/util-linux/util-linux/commit/24da33905c7115c4cbccd0afb2a469804e96467a"},{"type":"FIX","url":"https://github.com/util-linux/util-linux/commit/722c96974dd4009a334e4aee556eedaab5fb94b4"},{"type":"FIX","url":"https://github.com/util-linux/util-linux/commit/897a08c2b11dfa66975c3d24d63c7bf5f5be1a7c"},{"type":"FIX","url":"https://github.com/util-linux/util-linux/commit/d0c5adaeb3a3d823aba1377794de8f009b8152cc"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/util-linux/util-linux","events":[{"introduced":"2dccaae42bfdd0f1e34da11f2023480655308e1b"},{"fixed":"230de59ffbee328506d92d3534e66d56de1afe5d"},{"introduced":"0a7dfc376192e8fb1e7bdb2d0c90d8b9b173a42b"},{"fixed":"f44509230b9f8224993b8c6157f85888359a64e1"},{"fixed":"24da33905c7115c4cbccd0afb2a469804e96467a"},{"fixed":"722c96974dd4009a334e4aee556eedaab5fb94b4"},{"fixed":"897a08c2b11dfa66975c3d24d63c7bf5f5be1a7c"},{"fixed":"d0c5adaeb3a3d823aba1377794de8f009b8152cc"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"2.39"},{"fixed":"2.41.5"}],"source":"AFFECTED_FIELD","strategy":"StringRangeExpression"},{"source":"AFFECTED_FIELD","strategy":"StringRangeExpression","range":[{"introduced":"2.42"},{"fixed":"2.42.2"}]},{"range":[{"fixed":"24da33905c7115c4cbccd0afb2a469804e96467a"}],"source":"REFERENCES_COMMIT"},{"source":"REFERENCES_COMMIT","range":[{"fixed":"722c96974dd4009a334e4aee556eedaab5fb94b4"}]},{"source":"REFERENCES_COMMIT","range":[{"fixed":"897a08c2b11dfa66975c3d24d63c7bf5f5be1a7c"}]},{"range":[{"fixed":"d0c5adaeb3a3d823aba1377794de8f009b8152cc"}],"source":"REFERENCES_COMMIT"},{"range":[{"fixed":"230de59ffbee328506d92d3534e66d56de1afe5d"}],"source":"REFERENCES_TAG","original_tag":"v2.41.5"},{"source":"REFERENCES_TAG","original_tag":"v2.42.2","range":[{"fixed":"f44509230b9f8224993b8c6157f85888359a64e1"}]}]}}],"versions":["v2.41.4","v2.42.1","v2.42","v2.42-rc2","v2.42-rc1","v2.43-devel","v2.41.3","v2.41.2","v2.41.2-rc1","v2.41.1","v2.41","v2.41-rc2","v2.41-rc1","v2.42-start"],"database_specific":{"vanir_signatures":[{"signature_version":"v1","source":"https://github.com/util-linux/util-linux/commit/d0c5adaeb3a3d823aba1377794de8f009b8152cc","target":{"file":"libmount/src/hook_owner.c"},"deprecated":false,"digest":{"line_hashes":["189416551369317578669543412882443867900","203954655462430478336790746804361871949","73424103023934474004077771744283066934","226812520723057828447336759261413025020","287916872550250493061999531077277974086","295849846978343232703012997549569007218","309703407695369206694315440814082151631","253448594725717325904866246398054960451","61978719789124922946234296964484456330","93977077212558150032335596092213279824","120822042863989257646907409397106214811","156207524229868018457422046071878554994","105236332870103286380900300715958745844","147346496709246291054708992858019441806","44822227688965678918062290145544443322","3392822727522276796645780624875898997","142458269881086944690160848795980220136","111953038255370750561077472281157357260","125627127757821994354609847925063434669"],"threshold":0.9},"id":"CVE-2026-53612-06698249","signature_type":"Line"},{"signature_version":"v1","source":"https://github.com/util-linux/util-linux/commit/722c96974dd4009a334e4aee556eedaab5fb94b4","target":{"file":"libmount/src/context.c","function":"mnt_new_context"},"deprecated":false,"digest":{"function_hash":"241955429673722932822098594934582161441","length":520},"id":"CVE-2026-53612-168b82aa","signature_type":"Function"},{"source":"https://github.com/util-linux/util-linux/commit/722c96974dd4009a334e4aee556eedaab5fb94b4","target":{"file":"libmount/src/optstr.c","function":"mnt_optstr_get_uid"},"deprecated":false,"digest":{"function_hash":"147606000331489946801269568050808505717","length":744},"id":"CVE-2026-53612-3223c3f5","signature_type":"Function","signature_version":"v1"},{"digest":{"threshold":0.9,"line_hashes":["219866580342062925487030807880965687959","53623482331168986457200043624352344432","44743181972306932779219804107763872434","174213978814623117341234267377671035257","338835666756841790700312676664032639234","140415529480232337301586061638826922711","147989549742331139247561061448572584754","184506580566060191639694129318215213992","178015544606000376393995467512312604210","54673049061685435637256459114381089813","162214872527311878033606188570253598714","257535799664887635485543898448605063805","326957641451018309795765961935848267681","4726396687531167844729163776884495676","241790102731565084392875462262971094671","69259392114667410069887582814188555042","193860713709708033338463048333549919166","68445294513725786381452003210729762760","246611215819972040883874886843039781543","3049038780046815544161803978193695705","301393835863133712813930193519636077892","188390212100106506237587879495320692609","215163284466825763864401391827870758480","168625082227722263986684997495703857275","306055594554002162056183210259031405165","225066846028540145969860044652477715165"]},"id":"CVE-2026-53612-38d8b6ac","signature_type":"Line","signature_version":"v1","source":"https://github.com/util-linux/util-linux/commit/722c96974dd4009a334e4aee556eedaab5fb94b4","target":{"file":"libmount/src/optstr.c"},"deprecated":false},{"target":{"file":"libmount/src/hook_owner.c"},"deprecated":false,"digest":{"line_hashes":["189416551369317578669543412882443867900","203954655462430478336790746804361871949","73424103023934474004077771744283066934","226812520723057828447336759261413025020","287916872550250493061999531077277974086","295849846978343232703012997549569007218","309703407695369206694315440814082151631","299283310253745218150486744584969256897","54956780370383414072200360568932866106","311526915184278954521134678564160176532","308256457810392973629995318507367186930","156207524229868018457422046071878554994","98785556740003860988519020213367092850","48393596721820425220811258255192633669","328653079522987066112332166977795211875","193747028510116847983848983459505470657","142458269881086944690160848795980220136","111953038255370750561077472281157357260","125627127757821994354609847925063434669"],"threshold":0.9},"id":"CVE-2026-53612-5f121009","signature_type":"Line","signature_version":"v1","source":"https://github.com/util-linux/util-linux/commit/24da33905c7115c4cbccd0afb2a469804e96467a"},{"target":{"file":"libmount/src/context_mount.c","function":"mnt_context_prepare_mount"},"deprecated":false,"digest":{"function_hash":"323820629532487076674783580407759683700","length":1250},"id":"CVE-2026-53612-672ebea3","signature_type":"Function","signature_version":"v1","source":"https://github.com/util-linux/util-linux/commit/722c96974dd4009a334e4aee556eedaab5fb94b4"},{"digest":{"line_hashes":["318657182678959195678965298394491790257","158614761474782865210756080509917646149","21274288972874290176343967653937629533","25174148179217078529371525367105252141","71492783188552391555851929955180645558","183256858191964023933728303148298935711","233203318744824698919413528454061464562","249124430560867583580626981711895570401","264586714040310943919293006069560055931","256611972324117894725295140240440481094","278156122358885634182441354147101333880","323108028636000835440540634477701119033","145580468052443385412266255473815494366","154605671479721438061094820134833548333","288410442363928974503661408111938815055","92548350845199189683334386976634627520","109023439938606807005143236655906565019","293660043766301226764479662305412438030","287320378376424670024782823835499662831","112691983502829574677145391865607400593","314481695753045253816510102238255232305","156645886349461402600440870085958513648","71604924602971784241534462254801289759"],"threshold":0.9},"id":"CVE-2026-53612-708498c8","signature_type":"Line","signature_version":"v1","source":"https://github.com/util-linux/util-linux/commit/722c96974dd4009a334e4aee556eedaab5fb94b4","target":{"file":"libmount/src/context_mount.c"},"deprecated":false},{"target":{"file":"libmount/src/context_mount.c","function":"mnt_context_get_mount_excode"},"deprecated":false,"digest":{"function_hash":"234007855061141111751096589690383189257","length":9134},"id":"CVE-2026-53612-7e284762","signature_type":"Function","signature_version":"v1","source":"https://github.com/util-linux/util-linux/commit/722c96974dd4009a334e4aee556eedaab5fb94b4"},{"deprecated":false,"digest":{"function_hash":"76601812685479892285806783310035795668","length":2434},"id":"CVE-2026-53612-9e89fc6e","signature_type":"Function","signature_version":"v1","source":"https://github.com/util-linux/util-linux/commit/722c96974dd4009a334e4aee556eedaab5fb94b4","target":{"function":"do_mount","file":"libmount/src/context_mount.c"}},{"signature_version":"v1","source":"https://github.com/util-linux/util-linux/commit/722c96974dd4009a334e4aee556eedaab5fb94b4","target":{"file":"libmount/src/context.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["109365095605020756493872580659914400960","171272703356066447717875572894771318900","78203924488526033374089496296669231921","95371810284844204973405750906308817670","97059563233582972904480419607148201312","30433022698613846398493521322198383382","164928235486597159181625487444058714268","174021602611346362901140809467006941832","186108623141917351884904438292643696875","246839755662836046066448288783238091477","194272439893724999957620156889960167348","171197474230486916290869602147525534459","113979697880527289273276564569405985507","182689038742426706689632298171347304621","165371053931897886181307374142496963031"]},"id":"CVE-2026-53612-a07cb4fd","signature_type":"Line"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/util-linux/util-linux/commit/722c96974dd4009a334e4aee556eedaab5fb94b4","target":{"file":"libmount/src/utils.c"},"deprecated":false,"digest":{"line_hashes":["141895719367109838770629473496048088426","263124620117752314304300737076151847478","9714353685221509080741285956437678561"],"threshold":0.9},"id":"CVE-2026-53612-a09ecdf1"},{"target":{"file":"libmount/src/context.c","function":"mnt_reset_context"},"deprecated":false,"digest":{"length":1586,"function_hash":"71064860079994953840320946622124430339"},"id":"CVE-2026-53612-b8de810f","signature_type":"Function","signature_version":"v1","source":"https://github.com/util-linux/util-linux/commit/722c96974dd4009a334e4aee556eedaab5fb94b4"},{"id":"CVE-2026-53612-bccc4a49","signature_type":"Function","signature_version":"v1","source":"https://github.com/util-linux/util-linux/commit/722c96974dd4009a334e4aee556eedaab5fb94b4","target":{"file":"libmount/src/context_mount.c","function":"mnt_context_do_mount"},"deprecated":false,"digest":{"function_hash":"330610926186898986488074585350136754408","length":1600}},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["241226817777265213589983816046936310053","19904092358287192282675973313591546495","40994009372847891840193925043612295798","115548213020442616010963149653865223187","5507255916512087343290711971027067719","174376654566355094654777324194860420137","277900141496411966385812935780954148695"]},"id":"CVE-2026-53612-e2b7cf7d","signature_type":"Line","signature_version":"v1","source":"https://github.com/util-linux/util-linux/commit/722c96974dd4009a334e4aee556eedaab5fb94b4","target":{"file":"libmount/src/mountP.h"}},{"signature_version":"v1","source":"https://github.com/util-linux/util-linux/commit/897a08c2b11dfa66975c3d24d63c7bf5f5be1a7c","target":{"file":"libmount/src/hook_owner.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["189416551369317578669543412882443867900","203954655462430478336790746804361871949","73424103023934474004077771744283066934","226812520723057828447336759261413025020","287916872550250493061999531077277974086","295849846978343232703012997549569007218","309703407695369206694315440814082151631","253448594725717325904866246398054960451","61978719789124922946234296964484456330","93977077212558150032335596092213279824","120822042863989257646907409397106214811","156207524229868018457422046071878554994","105236332870103286380900300715958745844","147346496709246291054708992858019441806","44822227688965678918062290145544443322","3392822727522276796645780624875898997","142458269881086944690160848795980220136","111953038255370750561077472281157357260","125627127757821994354609847925063434669"]},"id":"CVE-2026-53612-f9ad4cfa","signature_type":"Line"}],"vanir_signatures_modified":"2026-10-24T07:14:13Z","source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-53612.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}