CVE-2026-78410High· 7.8▾ MidnightPoC availableA flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can red…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 42.9 · likelihood 0 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.2%
A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.
util-linux-main (all versions)util-linux (all versions)util-linuxutil-linuxrhel8/flatpak-runtimerhel8/flatpak-sdkutil-linuxopenshift/ose-rhel-coreos-8openshift/ose-rhel-coreos-9Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Upgrade to util-linux v2.41.6, v2.42.3, or later. Until a fix is applied, do not allow unprivileged /etc/fstab bind or rbind entries that also specify X-mount.owner, X-mount.group, or X-mount.mode, especially when the bind source is below a user-writable ancestor.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-78409High· 7.0Util-linux: util-linux: x-mount.subdir detached-tree resolution can escape via intermediate symlinks
CVE-2026-78408High· 7.9The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve()
CVE-2026-112940Medium· 6.3filelock: filelock: Arbitrary file overwrite via insecure database file reopening (CVE-2026-112940)
CVE-2026-80353Low· 3.6tomcat: tomcat: Unauthorized socket access via TOCTOU race condition (CVE-2026-80353)
CVE-2025-38440Medium· 4.7kernel: Linux kernel: Denial of Service due to race condition in mlx5e driver (CVE-2025-38440)
CVE-2025-37915Medium· 6.3kernel: net_sched: drr: Fix double list add in class with netem as child qdisc (CVE-2025-37915)