CVE-2026-76642

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-76642
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-76642.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-76642
Aliases
  • GHSA-m25x-3hj9-m26f
Downstream
ALPINE (1)
AZL (1)
BELL (1)
DEBIAN (1)
ECHO (1)
OESA (3)
openSUSE (2)
RHSA (1)
ROOT (2)
SUSE (3)
UBUNTU (1)
Related
openSUSE (2)
SUSE (3)
Published
2026-09-03T10:54:08Z
Modified
2026-10-22T16:40:34Z
Severity
  • 8.5 (High) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
util-linux libmount Privilege Escalation via Failed Mount Helper
Details

util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-390"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/76xxx/CVE-2026-76642.json"
}
References

Affected packages

Git / github.com/util-linux/util-linux

Affected ranges

Type
GIT
Repo
https://github.com/util-linux/util-linux
Events
Introduced
2dccaae42bfdd0f1e34da11f2023480655308e1b
Fixed
02822c9374fc72d38baf8a1f859eb0813970bf3f
Introduced
0a7dfc376192e8fb1e7bdb2d0c90d8b9b173a42b
Fixed
6f20a5defcf9066d4d2af372424a1576bd3d495d
Fixed
f57cea130839c0af8dc0525274267ae4cfd66bbf
Fixed
1d14676ea70003e9f5b2a6a76af0cadb1190411a
Fixed
a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "2.39"
                },
                {
                    "fixed": "2.41.6"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "range": [
                {
                    "introduced": "2.42"
                },
                {
                    "fixed": "2.42.3"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "range": [
                {
                    "fixed": "f57cea130839c0af8dc0525274267ae4cfd66bbf"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "1d14676ea70003e9f5b2a6a76af0cadb1190411a"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

v2.*
v2.41
v2.41-rc1
v2.41-rc2
v2.41.1
v2.41.2
v2.41.2-rc1
v2.41.3
v2.41.4
v2.41.5
v2.42
v2.42-rc1
v2.42-rc2
v2.42-start
v2.42.1
v2.42.2
v2.43-devel

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-76642.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "231834648963002285768291963693058281121",
            "length": 1541
        },
        "id": "CVE-2026-76642-02c5f09c",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc",
        "target": {
            "file": "libmount/src/context_mount.c",
            "function": "mnt_context_mount"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "231834648963002285768291963693058281121",
            "length": 1541
        },
        "id": "CVE-2026-76642-364af411",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a",
        "target": {
            "file": "libmount/src/context_mount.c",
            "function": "mnt_context_mount"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "133281925866185137591021574535477504190",
            "length": 253
        },
        "id": "CVE-2026-76642-46f46d62",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a",
        "target": {
            "file": "libmount/src/hook_loopdev.c",
            "function": "hookset_deinit"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "242289989841050256691018651834816396743",
            "length": 1541
        },
        "id": "CVE-2026-76642-48118b48",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf",
        "target": {
            "file": "libmount/src/context_mount.c",
            "function": "mnt_context_mount"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "55218515733450798731216135315735916816",
                "3921252240536986979700149378665315172",
                "277961465953627764036107494254536282790",
                "116312463450562576640736865666202195992",
                "286365227122950077258756110158610680107",
                "4370948598745793075799969918370406079",
                "321625399388288065797316329286763398233",
                "103175749726201353795086785314674694522",
                "277400334890740258290850723335185369218",
                "263198089839489699495144096384057141722",
                "244674509374242799767948705796383511211"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-76642-49e3e2c7",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc",
        "target": {
            "file": "libmount/src/context_mount.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "55218515733450798731216135315735916816",
                "3921252240536986979700149378665315172",
                "277961465953627764036107494254536282790",
                "116312463450562576640736865666202195992",
                "286365227122950077258756110158610680107",
                "4370948598745793075799969918370406079",
                "321625399388288065797316329286763398233",
                "103175749726201353795086785314674694522",
                "277400334890740258290850723335185369218",
                "263198089839489699495144096384057141722",
                "244674509374242799767948705796383511211"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-76642-63143645",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf",
        "target": {
            "file": "libmount/src/context_mount.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "55827025012798539621447988673971646146",
            "length": 1023
        },
        "id": "CVE-2026-76642-7a273734",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc",
        "target": {
            "file": "libmount/src/context_mount.c",
            "function": "mnt_context_do_mount"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "314485091134137154508197357793663630715",
            "length": 253
        },
        "id": "CVE-2026-76642-833ddf50",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf",
        "target": {
            "file": "libmount/src/hook_loopdev.c",
            "function": "hookset_deinit"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "17989711024947974121519068396662392088",
                "311889267921061494022393327700764872631",
                "78115924382164963739391726279642525773",
                "100479621781559039280967416493069183298",
                "117108681030351722332625637983199545564",
                "57987610330545539796159969617597419598",
                "194446008419049159158263308909908607334",
                "168250881839990326691700181141875524368"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-76642-a9870b0c",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc",
        "target": {
            "file": "libmount/src/hook_loopdev.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "207800752218999914478399995797338025413",
            "length": 1023
        },
        "id": "CVE-2026-76642-a9c83566",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf",
        "target": {
            "file": "libmount/src/context_mount.c",
            "function": "mnt_context_do_mount"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "55827025012798539621447988673971646146",
            "length": 1023
        },
        "id": "CVE-2026-76642-cedb1f78",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a",
        "target": {
            "file": "libmount/src/context_mount.c",
            "function": "mnt_context_do_mount"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "133281925866185137591021574535477504190",
            "length": 253
        },
        "id": "CVE-2026-76642-dbb87783",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc",
        "target": {
            "file": "libmount/src/hook_loopdev.c",
            "function": "hookset_deinit"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "17989711024947974121519068396662392088",
                "311889267921061494022393327700764872631",
                "78115924382164963739391726279642525773",
                "198602760997071500301932192730649687640",
                "87304573351533731340658457077414531463",
                "270897980139346454566214339069973491182",
                "194446008419049159158263308909908607334",
                "168250881839990326691700181141875524368"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-76642-e2941f61",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf",
        "target": {
            "file": "libmount/src/hook_loopdev.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "55218515733450798731216135315735916816",
                "3921252240536986979700149378665315172",
                "277961465953627764036107494254536282790",
                "116312463450562576640736865666202195992",
                "286365227122950077258756110158610680107",
                "4370948598745793075799969918370406079",
                "321625399388288065797316329286763398233",
                "103175749726201353795086785314674694522",
                "277400334890740258290850723335185369218",
                "263198089839489699495144096384057141722",
                "244674509374242799767948705796383511211"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-76642-e825cbc6",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a",
        "target": {
            "file": "libmount/src/context_mount.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "17989711024947974121519068396662392088",
                "311889267921061494022393327700764872631",
                "78115924382164963739391726279642525773",
                "100479621781559039280967416493069183298",
                "117108681030351722332625637983199545564",
                "57987610330545539796159969617597419598",
                "194446008419049159158263308909908607334",
                "168250881839990326691700181141875524368"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-76642-ed250ad0",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a",
        "target": {
            "file": "libmount/src/hook_loopdev.c"
        }
    }
]
vanir_signatures_modified 
"2026-10-22T16:40:34Z"