{"id":"CVE-2026-78410","title":"Util-linux: util-linux: restricted bind mounts do not pin the source, allowing x-mount.owner/group/mode redirection","summary":"A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can red…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-367"],"vendor":"Red Hat","product":"util-linux-main","affected":["util-linux-main (all versions)","util-linux (all versions)","util-linux","util-linux","rhel8/flatpak-runtime","rhel8/flatpak-sdk","util-linux","openshift/ose-rhel-coreos-8","openshift/ose-rhel-coreos-9"],"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"total","timestamp":"2026-09-04T18:43:04.874138Z"},"exploitAvailable":true,"published":"2026-09-02","updated":"2026-10-21","sourceUpdated":"2026-10-21T17:51:51.633Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-78410","references":[{"url":"https://access.redhat.com/errata/RHSA-2026:63162","label":"RHSA-2026:63162"},{"url":"https://access.redhat.com/security/cve/CVE-2026-78410"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2522684","label":"RHBZ#2522684"},{"url":"https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m"}],"tags":["cve.org","exploit-available"],"epss":0.00156,"epssPercentile":0.04357,"ingestedAt":"2026-10-21T18:09:27.272Z","slug":"CVE-2026-78410","body":"## Overview\n\nA flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.\n\n## Affected\n\n- `util-linux-main (all versions)`\n- `util-linux (all versions)`\n- `util-linux`\n- `util-linux`\n- `rhel8/flatpak-runtime`\n- `rhel8/flatpak-sdk`\n- `util-linux`\n- `openshift/ose-rhel-coreos-8`\n- `openshift/ose-rhel-coreos-9`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n### Workarounds\n\nUpgrade to util-linux v2.41.6, v2.42.3, or later. Until a fix is applied, do not allow unprivileged /etc/fstab bind or rbind entries that also specify X-mount.owner, X-mount.group, or X-mount.mode, especially when the bind source is below a user-writable ancestor.","depth":"midnight","depthScore":55,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[]}