CVE-2026-53614

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-53614
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-53614.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-53614
Aliases
  • GHSA-67r7-8m5w-22wx
Downstream
ALPINE (1)
AZL (1)
BELL (1)
DEBIAN (1)
ECHO (1)
OESA (3)
openSUSE (2)
SUSE (7)
UBUNTU (1)
Related
openSUSE (2)
SUSE (7)
Published
2026-10-14T15:40:53Z
Modified
2026-10-24T07:14:56Z
Severity
  • 7.0 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
util-linux LIBMOUNT_FORCE_MOUNT2 allows nosuid and noexec bypass
Details

util-linux is a random collection of Linux utilities. In util-linux 2.39.1 through 2.41.4 and 2.42 through 2.42.1, the SUID mount utility reads the attacker-controlled LIBMOUNT_FORCE_MOUNT2 environment variable with getenv(), allowing a local low-privileged user to force the non-atomic legacy bind-mount path. With an /etc/fstab bind mount authorized by user or users and protected by nosuid, noexec, or nodev, an attacker can race the window between the initial bind mount and the remount that applies those security flags and execute a SUID program from the temporarily unprotected mount, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-269",
        "CWE-807"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53614.json"
}
References

Affected packages

Git / github.com/util-linux/util-linux

Affected ranges

Type
GIT
Repo
https://github.com/util-linux/util-linux
Events
Introduced
e98ef85a8f934bccac2b984422a40f92955ac97d
Fixed
230de59ffbee328506d92d3534e66d56de1afe5d
Introduced
0a7dfc376192e8fb1e7bdb2d0c90d8b9b173a42b
Fixed
f44509230b9f8224993b8c6157f85888359a64e1
Fixed
31e37c1c7dcf25b76ccf41391fe934a75644c661
Fixed
53ff0fcdab12d69c60c971c69a3d0d173fa46ca9
Fixed
9cbfb823500f510b34767edabd3ffd5b436987b4
Fixed
cc81bbcec598cb91f0eb8456282f33eed820ed5f
Fixed
fd6b4d94ff013dc7ed680d4e864610da5b9751f1
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "2.39.1"
                },
                {
                    "fixed": "2.41.5"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "introduced": "2.42"
                },
                {
                    "fixed": "2.42.2"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "fixed": "31e37c1c7dcf25b76ccf41391fe934a75644c661"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "53ff0fcdab12d69c60c971c69a3d0d173fa46ca9"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "9cbfb823500f510b34767edabd3ffd5b436987b4"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "cc81bbcec598cb91f0eb8456282f33eed820ed5f"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "fd6b4d94ff013dc7ed680d4e864610da5b9751f1"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "v2.41.5",
            "range": [
                {
                    "fixed": "230de59ffbee328506d92d3534e66d56de1afe5d"
                }
            ],
            "source": "REFERENCES_TAG"
        },
        {
            "original_tag": "v2.42.2",
            "range": [
                {
                    "fixed": "f44509230b9f8224993b8c6157f85888359a64e1"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

v2.*
v2.41
v2.41-rc1
v2.41-rc2
v2.41.1
v2.41.2
v2.41.2-rc1
v2.41.3
v2.41.4
v2.42
v2.42-rc1
v2.42-rc2
v2.42-start
v2.42.1
v2.43-devel

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-53614.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "279600876306228466407149229976057628164",
                "31801594684547470108367074983191957509",
                "92345420892783547337667193793236685155",
                "143188086333116447689766397479996259848",
                "186977594877702219346708394611271700619",
                "91484787183976699370677912738587591183",
                "132848802445537131579864784985947900746",
                "194873570860359071209466102219728848315",
                "35361826491545906553062129707625743045",
                "250015717173208736141861653022214829081",
                "303179750775853543651096648157178305912",
                "107603230452550159032168052240633981599",
                "319951899289866975664679292373624649518"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-53614-4fb8138e",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/util-linux/util-linux/commit/31e37c1c7dcf25b76ccf41391fe934a75644c661",
        "target": {
            "file": "libmount/src/hook_mount_legacy.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "332101843444830497622651573446344535774",
                "74203008748288685169546661232757883776",
                "283039804557572253152148929906543926527",
                "59930583242720278439977191540122874389",
                "152948910433247727399184240989966231412"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-53614-716d65bf",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/util-linux/util-linux/commit/cc81bbcec598cb91f0eb8456282f33eed820ed5f",
        "target": {
            "file": "libmount/src/hook_mount.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "197104412748612578091235400625976890493",
                "74203008748288685169546661232757883776",
                "283039804557572253152148929906543926527",
                "59930583242720278439977191540122874389",
                "152948910433247727399184240989966231412"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-53614-b4c7008d",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/util-linux/util-linux/commit/9cbfb823500f510b34767edabd3ffd5b436987b4",
        "target": {
            "file": "libmount/src/hook_mount.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "279600876306228466407149229976057628164",
                "31801594684547470108367074983191957509",
                "92345420892783547337667193793236685155",
                "143188086333116447689766397479996259848",
                "186977594877702219346708394611271700619",
                "91484787183976699370677912738587591183",
                "132848802445537131579864784985947900746",
                "194873570860359071209466102219728848315",
                "35361826491545906553062129707625743045",
                "250015717173208736141861653022214829081",
                "303179750775853543651096648157178305912",
                "107603230452550159032168052240633981599",
                "319951899289866975664679292373624649518"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-53614-b4e55a6b",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/util-linux/util-linux/commit/9cbfb823500f510b34767edabd3ffd5b436987b4",
        "target": {
            "file": "libmount/src/hook_mount_legacy.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "197104412748612578091235400625976890493",
                "74203008748288685169546661232757883776",
                "283039804557572253152148929906543926527",
                "59930583242720278439977191540122874389",
                "152948910433247727399184240989966231412"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-53614-bc0089fe",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/util-linux/util-linux/commit/31e37c1c7dcf25b76ccf41391fe934a75644c661",
        "target": {
            "file": "libmount/src/hook_mount.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "154488258412709744799255233356703130183",
                "37120979073356628214764179795112848962",
                "249177636136996911605084167630013826990",
                "196004037682592797454511671451524236309",
                "333882094658918032423912321824078608456",
                "48138907833101787637168479078095296396",
                "293904583537830041146512036451966280607",
                "261602010833880397146742522754042445830",
                "78744238110802806588091463214568331520",
                "239653523260280826193493031176138394033",
                "47825075435829307108005695688711013993",
                "271496349420407872109631780169090857481"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-53614-c96bdc0d",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/util-linux/util-linux/commit/53ff0fcdab12d69c60c971c69a3d0d173fa46ca9",
        "target": {
            "file": "libmount/src/hook_mount.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "154488258412709744799255233356703130183",
                "37120979073356628214764179795112848962",
                "249177636136996911605084167630013826990",
                "196004037682592797454511671451524236309",
                "333882094658918032423912321824078608456",
                "48138907833101787637168479078095296396",
                "293904583537830041146512036451966280607",
                "261602010833880397146742522754042445830",
                "78744238110802806588091463214568331520",
                "239653523260280826193493031176138394033",
                "47825075435829307108005695688711013993",
                "271496349420407872109631780169090857481"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-53614-e2b3ff5b",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/util-linux/util-linux/commit/fd6b4d94ff013dc7ed680d4e864610da5b9751f1",
        "target": {
            "file": "libmount/src/hook_mount.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "279600876306228466407149229976057628164",
                "31801594684547470108367074983191957509",
                "92345420892783547337667193793236685155",
                "143188086333116447689766397479996259848",
                "186977594877702219346708394611271700619",
                "91484787183976699370677912738587591183",
                "132848802445537131579864784985947900746",
                "194873570860359071209466102219728848315",
                "35361826491545906553062129707625743045",
                "250015717173208736141861653022214829081",
                "303179750775853543651096648157178305912",
                "107603230452550159032168052240633981599",
                "319951899289866975664679292373624649518"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-53614-f1d8a916",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/util-linux/util-linux/commit/cc81bbcec598cb91f0eb8456282f33eed820ed5f",
        "target": {
            "file": "libmount/src/hook_mount_legacy.c"
        }
    }
]
vanir_signatures_modified 
"2026-10-24T07:14:56Z"