Local Privilege Escalation in util-linux via Race Condition

CVE-2026-78410 describes a critical security flaw in the util-linux package, specifically within the handling of restricted bind mounts. The vulnerability stems from the mount(8) command failing to properly pin the source path defined in the fstab file before executing the mount operation. This creates a time-of-check to time-of-use (TOCTOU) race condition. An unprivileged local user who has the ability to manipulate the directory structure or replace the source path can redirect the mount(8) operation to an arbitrary directory on the host. When the fstab entry includes administrative mount options such as X-mount.owner, X-mount.group, or X-mount.mode, the SUID-root mount binary inadvertently applies these permissions changes to the redirected target directory, leading to full privilege escalation. This issue impacts systems where users have permission to trigger mounts defined in fstab.

Impact

Successful exploitation of this vulnerability allows an unprivileged local attacker to elevate their privileges to root by changing the ownership or permissions of sensitive files or directories on the system. This can lead to total system compromise, unauthorized data access, and persistence. The vulnerability affects all systems utilizing the vulnerable version of the util-linux package, particularly those configured with user-accessible mount points in fstab.

Recommendation

Prioritize patching the util-linux package across all Linux distributions as soon as security updates are provided by upstream maintainers or OS vendors. Monitor for unauthorized usage of mount(8) by non-root users in local environments, specifically looking for process executions involving fstab-defined mount points and the use of user-controlled mount options.