CVE catalog
CVE-2026-53612
util-linux vulnerabilities
- Severity
- High · CVSS 7
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.15% · Oct 25, 2026
util-linux is a random collection of Linux utilities. In util-linux 2.39 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility's `hook_owner.c` post-mount hook performs path-based `chmod()` and `lchown()` operations on a previously validated mount target. A local low-privileged user authorized by an `/etc/fstab` entry with `user` or `users` and an `X-mount.mode`, `X-mount.owner`, or `X-mount.group` option can use `renameat2(RENAME_EXCHANGE)` to race a writable ancestor of the target and redirect the privileged ownership or mode change to a root-owned path, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | util-linux | sid | 2.42.4-1 | fixed |
| Debian | util-linux | forky | 2.42.4-1 | fixed |
| Debian | util-linux | trixie | 2.41.5-0+deb13u1 | fixed |
| Debian | util-linux | trixie-security | 2.41.5-0+deb13u1 | fixed |
| Debian | util-linux | bookworm | 2.38.1-5+deb12u3 | not affected |
| Debian | util-linux | bookworm-security | 2.38.1-5+deb12u1 | not affected |
| Ubuntu | util-linux | noble | Not reported | not affected |
| Ubuntu | util-linux | noble | 2.39.3-9ubuntu6.6 | fixed |
| Ubuntu | bsdextrautils | noble | 2.39.3-9ubuntu6.6 | fixed |
| Ubuntu | bsdutils | noble | 1:2.39.3-9ubuntu6.6 | fixed |
| Ubuntu | eject | noble | 2.39.3-9ubuntu6.6 | fixed |
| Ubuntu | fdisk | noble | 2.39.3-9ubuntu6.6 | fixed |
| Ubuntu | libblkid-dev | noble | 2.39.3-9ubuntu6.6 | fixed |
| Ubuntu | libblkid1 | noble | 2.39.3-9ubuntu6.6 | fixed |
| Ubuntu | libfdisk-dev | noble | 2.39.3-9ubuntu6.6 | fixed |
| Ubuntu | libfdisk1 | noble | 2.39.3-9ubuntu6.6 | fixed |
| Ubuntu | libmount-dev | noble | 2.39.3-9ubuntu6.6 | fixed |
| Ubuntu | libmount1 | noble | 2.39.3-9ubuntu6.6 | fixed |
| Ubuntu | libsmartcols-dev | noble | 2.39.3-9ubuntu6.6 | fixed |
| Ubuntu | libsmartcols1 | noble | 2.39.3-9ubuntu6.6 | fixed |
| Ubuntu | libuuid1 | noble | 2.39.3-9ubuntu6.6 | fixed |
| Ubuntu | mount | noble | 2.39.3-9ubuntu6.6 | fixed |
| Ubuntu | rfkill | noble | 2.39.3-9ubuntu6.6 | fixed |
| Ubuntu | util-linux-extra | noble | 2.39.3-9ubuntu6.6 | fixed |
| Ubuntu | util-linux-locales | noble | 2.39.3-9ubuntu6.6 | fixed |
| Ubuntu | uuid-dev | noble | 2.39.3-9ubuntu6.6 | fixed |
| Ubuntu | uuid-runtime | noble | 2.39.3-9ubuntu6.6 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | util-linux | source | sid | 2.42.2-1 | not yet assigned | Not reported | [1140194] |
| Debian | util-linux | source | forky | 2.42.2-1 | not yet assigned | Not reported | [1140194] |
| Debian | util-linux | source | trixie | 2.41.5-0+deb13u1 | not yet assigned | Not reported | [1140194] |
| Debian | util-linux | source | bookworm | Not affected | unimportant | Not reported | [1140194] |
| Ubuntu | util-linux | deb | noble | 2.39.3-9ubuntu6.6 | Not reported | Not reported | Not reported |
| Ubuntu | bsdextrautils | deb | noble | 2.39.3-9ubuntu6.6 | Not reported | Not reported | Not reported |
| Ubuntu | bsdutils | deb | noble | 1:2.39.3-9ubuntu6.6 | Not reported | Not reported | Not reported |
| Ubuntu | eject | deb | noble | 2.39.3-9ubuntu6.6 | Not reported | Not reported | Not reported |
| Ubuntu | fdisk | deb | noble | 2.39.3-9ubuntu6.6 | Not reported | Not reported | Not reported |
| Ubuntu | libblkid-dev | deb | noble | 2.39.3-9ubuntu6.6 | Not reported | Not reported | Not reported |
| Ubuntu | libblkid1 | deb | noble | 2.39.3-9ubuntu6.6 | Not reported | Not reported | Not reported |
| Ubuntu | libfdisk-dev | deb | noble | 2.39.3-9ubuntu6.6 | Not reported | Not reported | Not reported |
| Ubuntu | libfdisk1 | deb | noble | 2.39.3-9ubuntu6.6 | Not reported | Not reported | Not reported |
| Ubuntu | libmount-dev | deb | noble | 2.39.3-9ubuntu6.6 | Not reported | Not reported | Not reported |
| Ubuntu | libmount1 | deb | noble | 2.39.3-9ubuntu6.6 | Not reported | Not reported | Not reported |
| Ubuntu | libsmartcols-dev | deb | noble | 2.39.3-9ubuntu6.6 | Not reported | Not reported | Not reported |
| Ubuntu | libsmartcols1 | deb | noble | 2.39.3-9ubuntu6.6 | Not reported | Not reported | Not reported |
| Ubuntu | libuuid1 | deb | noble | 2.39.3-9ubuntu6.6 | Not reported | Not reported | Not reported |
| Ubuntu | mount | deb | noble | 2.39.3-9ubuntu6.6 | Not reported | Not reported | Not reported |
| Ubuntu | rfkill | deb | noble | 2.39.3-9ubuntu6.6 | Not reported | Not reported | Not reported |
| Ubuntu | util-linux-extra | deb | noble | 2.39.3-9ubuntu6.6 | Not reported | Not reported | Not reported |
| Ubuntu | util-linux-locales | deb | noble | 2.39.3-9ubuntu6.6 | Not reported | Not reported | Not reported |
| Ubuntu | uuid-dev | deb | noble | 2.39.3-9ubuntu6.6 | Not reported | Not reported | Not reported |
| Ubuntu | uuid-runtime | deb | noble | 2.39.3-9ubuntu6.6 | Not reported | Not reported | Not reported |
OpenFactory catalog packages
[Debian 13 (Trixie)]
- [bsdextrautils]Affected
Source package: [util-linux]
Details (4)
2.41-5· amd64 · trixieAffected · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41-5· arm64 · trixieAffected · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41.5-0+deb13u1· amd64 · trixie-securityFixed · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41.5-0+deb13u1· arm64 · trixie-securityFixed · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
- [bsdutils]Affected
Source package: [util-linux]
Details (4)
1:2.41-5· amd64 · trixieAffected · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
1:2.41-5· arm64 · trixieAffected · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
1:2.41.5-0+deb13u1· amd64 · trixie-securityFixed · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
1:2.41.5-0+deb13u1· arm64 · trixie-securityFixed · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
- [eject]Affected
Source package: [util-linux]
Details (4)
2.41-5· amd64 · trixieAffected · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41-5· arm64 · trixieAffected · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41.5-0+deb13u1· amd64 · trixie-securityFixed · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41.5-0+deb13u1· arm64 · trixie-securityFixed · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
- [fdisk]Affected
Source package: [util-linux]
Details (4)
2.41-5· amd64 · trixieAffected · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41-5· arm64 · trixieAffected · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41.5-0+deb13u1· amd64 · trixie-securityFixed · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41.5-0+deb13u1· arm64 · trixie-securityFixed · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
- [lastlog2]Affected
Source package: [util-linux]
Details (4)
2.41-5· amd64 · trixieAffected · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41-5· arm64 · trixieAffected · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41.5-0+deb13u1· amd64 · trixie-securityFixed · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41.5-0+deb13u1· arm64 · trixie-securityFixed · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
- [libblkid1]Affected
Source package: [util-linux]
Details (4)
2.41-5· amd64 · trixieAffected · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41-5· arm64 · trixieAffected · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41.5-0+deb13u1· amd64 · trixie-securityFixed · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41.5-0+deb13u1· arm64 · trixie-securityFixed · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
- [libblkid-dev]Affected
Source package: [util-linux]
Details (4)
2.41-5· amd64 · trixieAffected · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41-5· arm64 · trixieAffected · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41.5-0+deb13u1· amd64 · trixie-securityFixed · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41.5-0+deb13u1· arm64 · trixie-securityFixed · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
- [libfdisk1]Affected
Source package: [util-linux]
Details (4)
2.41-5· amd64 · trixieAffected · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41-5· arm64 · trixieAffected · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41.5-0+deb13u1· amd64 · trixie-securityFixed · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41.5-0+deb13u1· arm64 · trixie-securityFixed · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
- [libfdisk-dev]Affected
Source package: [util-linux]
Details (4)
2.41-5· amd64 · trixieAffected · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41-5· arm64 · trixieAffected · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41.5-0+deb13u1· amd64 · trixie-securityFixed · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41.5-0+deb13u1· arm64 · trixie-securityFixed · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
- [liblastlog2-2]Affected
Source package: [util-linux]
Details (4)
2.41-5· amd64 · trixieAffected · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41-5· arm64 · trixieAffected · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41.5-0+deb13u1· amd64 · trixie-securityFixed · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41.5-0+deb13u1· arm64 · trixie-securityFixed · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
- [liblastlog2-dev]Affected
Source package: [util-linux]
Details (4)
2.41-5· amd64 · trixieAffected · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41-5· arm64 · trixieAffected · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41.5-0+deb13u1· amd64 · trixie-securityFixed · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41.5-0+deb13u1· arm64 · trixie-securityFixed · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
- [libmount1]Affected
Source package: [util-linux]
Details (4)
2.41-5· amd64 · trixieAffected · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41-5· arm64 · trixieAffected · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41.5-0+deb13u1· amd64 · trixie-securityFixed · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41.5-0+deb13u1· arm64 · trixie-securityFixed · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
- [libmount-dev]Affected
Source package: [util-linux]
Details (4)
2.41-5· amd64 · trixieAffected · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41-5· arm64 · trixieAffected · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41.5-0+deb13u1· amd64 · trixie-securityFixed · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41.5-0+deb13u1· arm64 · trixie-securityFixed · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
- [libpam-lastlog2]Affected
Source package: [util-linux]
Details (4)
2.41-5· amd64 · trixieAffected · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41-5· arm64 · trixieAffected · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41.5-0+deb13u1· amd64 · trixie-securityFixed · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41.5-0+deb13u1· arm64 · trixie-securityFixed · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
- [libsmartcols1]Affected
Source package: [util-linux]
Details (4)
2.41-5· amd64 · trixieAffected · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41-5· arm64 · trixieAffected · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41.5-0+deb13u1· amd64 · trixie-securityFixed · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41.5-0+deb13u1· arm64 · trixie-securityFixed · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
- [libsmartcols-dev]Affected
Source package: [util-linux]
Details (4)
2.41-5· amd64 · trixieAffected · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41-5· arm64 · trixieAffected · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41.5-0+deb13u1· amd64 · trixie-securityFixed · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41.5-0+deb13u1· arm64 · trixie-securityFixed · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
- [libuuid1]Affected
Source package: [util-linux]
Details (4)
2.41-5· amd64 · trixieAffected · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41-5· arm64 · trixieAffected · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41.5-0+deb13u1· amd64 · trixie-securityFixed · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41.5-0+deb13u1· arm64 · trixie-securityFixed · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
- [login]Affected
Source package: [util-linux]
Details (4)
1:4.16.0-2+really2.41-5· amd64 · trixieAffected · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
1:4.16.0-2+really2.41-5· arm64 · trixieAffected · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
1:4.16.0-2+really2.41.5-0+deb13u1· amd64 · trixie-securityFixed · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
1:4.16.0-2+really2.41.5-0+deb13u1· arm64 · trixie-securityFixed · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
- [mount]Affected
Source package: [util-linux]
Details (4)
2.41-5· amd64 · trixieAffected · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41-5· arm64 · trixieAffected · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41.5-0+deb13u1· amd64 · trixie-securityFixed · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41.5-0+deb13u1· arm64 · trixie-securityFixed · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
- [rfkill]Affected
Source package: [util-linux]
Details (4)
2.41-5· amd64 · trixieAffected · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41-5· arm64 · trixieAffected · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41.5-0+deb13u1· amd64 · trixie-securityFixed · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41.5-0+deb13u1· arm64 · trixie-securityFixed · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
Observed:
References
- [https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_11408-1.json]
- [https://nvd.nist.gov/vuln/detail/CVE-2026-53612]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2026-53612]
- [https://security-tracker.debian.org/tracker/CVE-2026-53612]
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53612.json]
- [https://ubuntu.com/security/notices/USN-8702-1]
- [https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-2938.json]
[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]