CVE-2026-53612

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-53612
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-53612.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-53612
Aliases
  • GHSA-g8wm-75wr-g2vh
Downstream
ALPINE (1)
AZL (1)
BELL (1)
DEBIAN (1)
ECHO (1)
OESA (3)
openSUSE (2)
SUSE (7)
UBUNTU (1)
Related
openSUSE (2)
SUSE (7)
Published
2026-10-14T14:47:25Z
Modified
2026-10-24T07:14:13Z
Severity
  • 7.0 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
util-linux mount hook_owner TOCTOU allows local privilege escalation
Details

util-linux is a random collection of Linux utilities. In util-linux 2.39 through 2.41.4 and 2.42 through 2.42.1, the SUID mount utility's hook_owner.c post-mount hook performs path-based chmod() and lchown() operations on a previously validated mount target. A local low-privileged user authorized by an /etc/fstab entry with user or users and an X-mount.mode, X-mount.owner, or X-mount.group option can use renameat2(RENAME_EXCHANGE) to race a writable ancestor of the target and redirect the privileged ownership or mode change to a root-owned path, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-367"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53612.json"
}
References

Affected packages

Git / github.com/util-linux/util-linux

Affected ranges

Type
GIT
Repo
https://github.com/util-linux/util-linux
Events
Introduced
2dccaae42bfdd0f1e34da11f2023480655308e1b
Fixed
230de59ffbee328506d92d3534e66d56de1afe5d
Introduced
0a7dfc376192e8fb1e7bdb2d0c90d8b9b173a42b
Fixed
f44509230b9f8224993b8c6157f85888359a64e1
Fixed
24da33905c7115c4cbccd0afb2a469804e96467a
Fixed
722c96974dd4009a334e4aee556eedaab5fb94b4
Fixed
897a08c2b11dfa66975c3d24d63c7bf5f5be1a7c
Fixed
d0c5adaeb3a3d823aba1377794de8f009b8152cc
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "2.39"
                },
                {
                    "fixed": "2.41.5"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "introduced": "2.42"
                },
                {
                    "fixed": "2.42.2"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "fixed": "24da33905c7115c4cbccd0afb2a469804e96467a"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "722c96974dd4009a334e4aee556eedaab5fb94b4"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "897a08c2b11dfa66975c3d24d63c7bf5f5be1a7c"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "d0c5adaeb3a3d823aba1377794de8f009b8152cc"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "v2.41.5",
            "range": [
                {
                    "fixed": "230de59ffbee328506d92d3534e66d56de1afe5d"
                }
            ],
            "source": "REFERENCES_TAG"
        },
        {
            "original_tag": "v2.42.2",
            "range": [
                {
                    "fixed": "f44509230b9f8224993b8c6157f85888359a64e1"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

v2.*
v2.41
v2.41-rc1
v2.41-rc2
v2.41.1
v2.41.2
v2.41.2-rc1
v2.41.3
v2.41.4
v2.42
v2.42-rc1
v2.42-rc2
v2.42-start
v2.42.1
v2.43-devel

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-53612.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "189416551369317578669543412882443867900",
                "203954655462430478336790746804361871949",
                "73424103023934474004077771744283066934",
                "226812520723057828447336759261413025020",
                "287916872550250493061999531077277974086",
                "295849846978343232703012997549569007218",
                "309703407695369206694315440814082151631",
                "253448594725717325904866246398054960451",
                "61978719789124922946234296964484456330",
                "93977077212558150032335596092213279824",
                "120822042863989257646907409397106214811",
                "156207524229868018457422046071878554994",
                "105236332870103286380900300715958745844",
                "147346496709246291054708992858019441806",
                "44822227688965678918062290145544443322",
                "3392822727522276796645780624875898997",
                "142458269881086944690160848795980220136",
                "111953038255370750561077472281157357260",
                "125627127757821994354609847925063434669"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-53612-06698249",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/util-linux/util-linux/commit/d0c5adaeb3a3d823aba1377794de8f009b8152cc",
        "target": {
            "file": "libmount/src/hook_owner.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "241955429673722932822098594934582161441",
            "length": 520
        },
        "id": "CVE-2026-53612-168b82aa",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/util-linux/util-linux/commit/722c96974dd4009a334e4aee556eedaab5fb94b4",
        "target": {
            "file": "libmount/src/context.c",
            "function": "mnt_new_context"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "147606000331489946801269568050808505717",
            "length": 744
        },
        "id": "CVE-2026-53612-3223c3f5",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/util-linux/util-linux/commit/722c96974dd4009a334e4aee556eedaab5fb94b4",
        "target": {
            "file": "libmount/src/optstr.c",
            "function": "mnt_optstr_get_uid"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "219866580342062925487030807880965687959",
                "53623482331168986457200043624352344432",
                "44743181972306932779219804107763872434",
                "174213978814623117341234267377671035257",
                "338835666756841790700312676664032639234",
                "140415529480232337301586061638826922711",
                "147989549742331139247561061448572584754",
                "184506580566060191639694129318215213992",
                "178015544606000376393995467512312604210",
                "54673049061685435637256459114381089813",
                "162214872527311878033606188570253598714",
                "257535799664887635485543898448605063805",
                "326957641451018309795765961935848267681",
                "4726396687531167844729163776884495676",
                "241790102731565084392875462262971094671",
                "69259392114667410069887582814188555042",
                "193860713709708033338463048333549919166",
                "68445294513725786381452003210729762760",
                "246611215819972040883874886843039781543",
                "3049038780046815544161803978193695705",
                "301393835863133712813930193519636077892",
                "188390212100106506237587879495320692609",
                "215163284466825763864401391827870758480",
                "168625082227722263986684997495703857275",
                "306055594554002162056183210259031405165",
                "225066846028540145969860044652477715165"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-53612-38d8b6ac",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/util-linux/util-linux/commit/722c96974dd4009a334e4aee556eedaab5fb94b4",
        "target": {
            "file": "libmount/src/optstr.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "189416551369317578669543412882443867900",
                "203954655462430478336790746804361871949",
                "73424103023934474004077771744283066934",
                "226812520723057828447336759261413025020",
                "287916872550250493061999531077277974086",
                "295849846978343232703012997549569007218",
                "309703407695369206694315440814082151631",
                "299283310253745218150486744584969256897",
                "54956780370383414072200360568932866106",
                "311526915184278954521134678564160176532",
                "308256457810392973629995318507367186930",
                "156207524229868018457422046071878554994",
                "98785556740003860988519020213367092850",
                "48393596721820425220811258255192633669",
                "328653079522987066112332166977795211875",
                "193747028510116847983848983459505470657",
                "142458269881086944690160848795980220136",
                "111953038255370750561077472281157357260",
                "125627127757821994354609847925063434669"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-53612-5f121009",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/util-linux/util-linux/commit/24da33905c7115c4cbccd0afb2a469804e96467a",
        "target": {
            "file": "libmount/src/hook_owner.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "323820629532487076674783580407759683700",
            "length": 1250
        },
        "id": "CVE-2026-53612-672ebea3",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/util-linux/util-linux/commit/722c96974dd4009a334e4aee556eedaab5fb94b4",
        "target": {
            "file": "libmount/src/context_mount.c",
            "function": "mnt_context_prepare_mount"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "318657182678959195678965298394491790257",
                "158614761474782865210756080509917646149",
                "21274288972874290176343967653937629533",
                "25174148179217078529371525367105252141",
                "71492783188552391555851929955180645558",
                "183256858191964023933728303148298935711",
                "233203318744824698919413528454061464562",
                "249124430560867583580626981711895570401",
                "264586714040310943919293006069560055931",
                "256611972324117894725295140240440481094",
                "278156122358885634182441354147101333880",
                "323108028636000835440540634477701119033",
                "145580468052443385412266255473815494366",
                "154605671479721438061094820134833548333",
                "288410442363928974503661408111938815055",
                "92548350845199189683334386976634627520",
                "109023439938606807005143236655906565019",
                "293660043766301226764479662305412438030",
                "287320378376424670024782823835499662831",
                "112691983502829574677145391865607400593",
                "314481695753045253816510102238255232305",
                "156645886349461402600440870085958513648",
                "71604924602971784241534462254801289759"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-53612-708498c8",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/util-linux/util-linux/commit/722c96974dd4009a334e4aee556eedaab5fb94b4",
        "target": {
            "file": "libmount/src/context_mount.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "234007855061141111751096589690383189257",
            "length": 9134
        },
        "id": "CVE-2026-53612-7e284762",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/util-linux/util-linux/commit/722c96974dd4009a334e4aee556eedaab5fb94b4",
        "target": {
            "file": "libmount/src/context_mount.c",
            "function": "mnt_context_get_mount_excode"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "76601812685479892285806783310035795668",
            "length": 2434
        },
        "id": "CVE-2026-53612-9e89fc6e",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/util-linux/util-linux/commit/722c96974dd4009a334e4aee556eedaab5fb94b4",
        "target": {
            "file": "libmount/src/context_mount.c",
            "function": "do_mount"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "109365095605020756493872580659914400960",
                "171272703356066447717875572894771318900",
                "78203924488526033374089496296669231921",
                "95371810284844204973405750906308817670",
                "97059563233582972904480419607148201312",
                "30433022698613846398493521322198383382",
                "164928235486597159181625487444058714268",
                "174021602611346362901140809467006941832",
                "186108623141917351884904438292643696875",
                "246839755662836046066448288783238091477",
                "194272439893724999957620156889960167348",
                "171197474230486916290869602147525534459",
                "113979697880527289273276564569405985507",
                "182689038742426706689632298171347304621",
                "165371053931897886181307374142496963031"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-53612-a07cb4fd",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/util-linux/util-linux/commit/722c96974dd4009a334e4aee556eedaab5fb94b4",
        "target": {
            "file": "libmount/src/context.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "141895719367109838770629473496048088426",
                "263124620117752314304300737076151847478",
                "9714353685221509080741285956437678561"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-53612-a09ecdf1",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/util-linux/util-linux/commit/722c96974dd4009a334e4aee556eedaab5fb94b4",
        "target": {
            "file": "libmount/src/utils.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "71064860079994953840320946622124430339",
            "length": 1586
        },
        "id": "CVE-2026-53612-b8de810f",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/util-linux/util-linux/commit/722c96974dd4009a334e4aee556eedaab5fb94b4",
        "target": {
            "file": "libmount/src/context.c",
            "function": "mnt_reset_context"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "330610926186898986488074585350136754408",
            "length": 1600
        },
        "id": "CVE-2026-53612-bccc4a49",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/util-linux/util-linux/commit/722c96974dd4009a334e4aee556eedaab5fb94b4",
        "target": {
            "file": "libmount/src/context_mount.c",
            "function": "mnt_context_do_mount"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "241226817777265213589983816046936310053",
                "19904092358287192282675973313591546495",
                "40994009372847891840193925043612295798",
                "115548213020442616010963149653865223187",
                "5507255916512087343290711971027067719",
                "174376654566355094654777324194860420137",
                "277900141496411966385812935780954148695"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-53612-e2b7cf7d",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/util-linux/util-linux/commit/722c96974dd4009a334e4aee556eedaab5fb94b4",
        "target": {
            "file": "libmount/src/mountP.h"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "189416551369317578669543412882443867900",
                "203954655462430478336790746804361871949",
                "73424103023934474004077771744283066934",
                "226812520723057828447336759261413025020",
                "287916872550250493061999531077277974086",
                "295849846978343232703012997549569007218",
                "309703407695369206694315440814082151631",
                "253448594725717325904866246398054960451",
                "61978719789124922946234296964484456330",
                "93977077212558150032335596092213279824",
                "120822042863989257646907409397106214811",
                "156207524229868018457422046071878554994",
                "105236332870103286380900300715958745844",
                "147346496709246291054708992858019441806",
                "44822227688965678918062290145544443322",
                "3392822727522276796645780624875898997",
                "142458269881086944690160848795980220136",
                "111953038255370750561077472281157357260",
                "125627127757821994354609847925063434669"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-53612-f9ad4cfa",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/util-linux/util-linux/commit/897a08c2b11dfa66975c3d24d63c7bf5f5be1a7c",
        "target": {
            "file": "libmount/src/hook_owner.c"
        }
    }
]
vanir_signatures_modified 
"2026-10-24T07:14:13Z"