CVE catalog
CVE-2026-53614
util-linux vulnerabilities
- Severity
- High · CVSS 7
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.13% · Oct 25, 2026
util-linux is a random collection of Linux utilities. In util-linux 2.39.1 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility reads the attacker-controlled `LIBMOUNT_FORCE_MOUNT2` environment variable with `getenv()`, allowing a local low-privileged user to force the non-atomic legacy bind-mount path. With an `/etc/fstab` bind mount authorized by `user` or `users` and protected by `nosuid`, `noexec`, or `nodev`, an attacker can race the window between the initial bind mount and the remount that applies those security flags and execute a SUID program from the temporarily unprotected mount, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | util-linux | sid | 2.42.4-1 | fixed |
| Debian | util-linux | forky | 2.42.4-1 | fixed |
| Debian | util-linux | trixie | 2.41.5-0+deb13u1 | fixed |
| Debian | util-linux | trixie-security | 2.41.5-0+deb13u1 | fixed |
| Debian | util-linux | bookworm | 2.38.1-5+deb12u3 | not affected |
| Debian | util-linux | bookworm-security | 2.38.1-5+deb12u1 | not affected |
| Ubuntu | util-linux | noble | Not reported | not affected |
| Ubuntu | util-linux | noble | 2.39.3-9ubuntu6.6 | fixed |
| Ubuntu | bsdextrautils | noble | 2.39.3-9ubuntu6.6 | fixed |
| Ubuntu | bsdutils | noble | 1:2.39.3-9ubuntu6.6 | fixed |
| Ubuntu | eject | noble | 2.39.3-9ubuntu6.6 | fixed |
| Ubuntu | fdisk | noble | 2.39.3-9ubuntu6.6 | fixed |
| Ubuntu | libblkid-dev | noble | 2.39.3-9ubuntu6.6 | fixed |
| Ubuntu | libblkid1 | noble | 2.39.3-9ubuntu6.6 | fixed |
| Ubuntu | libfdisk-dev | noble | 2.39.3-9ubuntu6.6 | fixed |
| Ubuntu | libfdisk1 | noble | 2.39.3-9ubuntu6.6 | fixed |
| Ubuntu | libmount-dev | noble | 2.39.3-9ubuntu6.6 | fixed |
| Ubuntu | libmount1 | noble | 2.39.3-9ubuntu6.6 | fixed |
| Ubuntu | libsmartcols-dev | noble | 2.39.3-9ubuntu6.6 | fixed |
| Ubuntu | libsmartcols1 | noble | 2.39.3-9ubuntu6.6 | fixed |
| Ubuntu | libuuid1 | noble | 2.39.3-9ubuntu6.6 | fixed |
| Ubuntu | mount | noble | 2.39.3-9ubuntu6.6 | fixed |
| Ubuntu | rfkill | noble | 2.39.3-9ubuntu6.6 | fixed |
| Ubuntu | util-linux-extra | noble | 2.39.3-9ubuntu6.6 | fixed |
| Ubuntu | util-linux-locales | noble | 2.39.3-9ubuntu6.6 | fixed |
| Ubuntu | uuid-dev | noble | 2.39.3-9ubuntu6.6 | fixed |
| Ubuntu | uuid-runtime | noble | 2.39.3-9ubuntu6.6 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | util-linux | source | sid | 2.42.2-1 | not yet assigned | Not reported | [1140196] |
| Debian | util-linux | source | forky | 2.42.2-1 | not yet assigned | Not reported | [1140196] |
| Debian | util-linux | source | trixie | 2.41.5-0+deb13u1 | not yet assigned | Not reported | [1140196] |
| Debian | util-linux | source | bookworm | Not affected | unimportant | Not reported | [1140196] |
| Ubuntu | util-linux | deb | noble | 2.39.3-9ubuntu6.6 | Not reported | Not reported | Not reported |
| Ubuntu | bsdextrautils | deb | noble | 2.39.3-9ubuntu6.6 | Not reported | Not reported | Not reported |
| Ubuntu | bsdutils | deb | noble | 1:2.39.3-9ubuntu6.6 | Not reported | Not reported | Not reported |
| Ubuntu | eject | deb | noble | 2.39.3-9ubuntu6.6 | Not reported | Not reported | Not reported |
| Ubuntu | fdisk | deb | noble | 2.39.3-9ubuntu6.6 | Not reported | Not reported | Not reported |
| Ubuntu | libblkid-dev | deb | noble | 2.39.3-9ubuntu6.6 | Not reported | Not reported | Not reported |
| Ubuntu | libblkid1 | deb | noble | 2.39.3-9ubuntu6.6 | Not reported | Not reported | Not reported |
| Ubuntu | libfdisk-dev | deb | noble | 2.39.3-9ubuntu6.6 | Not reported | Not reported | Not reported |
| Ubuntu | libfdisk1 | deb | noble | 2.39.3-9ubuntu6.6 | Not reported | Not reported | Not reported |
| Ubuntu | libmount-dev | deb | noble | 2.39.3-9ubuntu6.6 | Not reported | Not reported | Not reported |
| Ubuntu | libmount1 | deb | noble | 2.39.3-9ubuntu6.6 | Not reported | Not reported | Not reported |
| Ubuntu | libsmartcols-dev | deb | noble | 2.39.3-9ubuntu6.6 | Not reported | Not reported | Not reported |
| Ubuntu | libsmartcols1 | deb | noble | 2.39.3-9ubuntu6.6 | Not reported | Not reported | Not reported |
| Ubuntu | libuuid1 | deb | noble | 2.39.3-9ubuntu6.6 | Not reported | Not reported | Not reported |
| Ubuntu | mount | deb | noble | 2.39.3-9ubuntu6.6 | Not reported | Not reported | Not reported |
| Ubuntu | rfkill | deb | noble | 2.39.3-9ubuntu6.6 | Not reported | Not reported | Not reported |
| Ubuntu | util-linux-extra | deb | noble | 2.39.3-9ubuntu6.6 | Not reported | Not reported | Not reported |
| Ubuntu | util-linux-locales | deb | noble | 2.39.3-9ubuntu6.6 | Not reported | Not reported | Not reported |
| Ubuntu | uuid-dev | deb | noble | 2.39.3-9ubuntu6.6 | Not reported | Not reported | Not reported |
| Ubuntu | uuid-runtime | deb | noble | 2.39.3-9ubuntu6.6 | Not reported | Not reported | Not reported |
OpenFactory catalog packages
[Debian 13 (Trixie)]
- [bsdextrautils]Affected
Source package: [util-linux]
Details (4)
2.41-5· amd64 · trixieAffected · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41-5· arm64 · trixieAffected · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41.5-0+deb13u1· amd64 · trixie-securityFixed · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41.5-0+deb13u1· arm64 · trixie-securityFixed · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
- [bsdutils]Affected
Source package: [util-linux]
Details (4)
1:2.41-5· amd64 · trixieAffected · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
1:2.41-5· arm64 · trixieAffected · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
1:2.41.5-0+deb13u1· amd64 · trixie-securityFixed · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
1:2.41.5-0+deb13u1· arm64 · trixie-securityFixed · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
- [eject]Affected
Source package: [util-linux]
Details (4)
2.41-5· amd64 · trixieAffected · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41-5· arm64 · trixieAffected · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41.5-0+deb13u1· amd64 · trixie-securityFixed · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41.5-0+deb13u1· arm64 · trixie-securityFixed · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
- [fdisk]Affected
Source package: [util-linux]
Details (4)
2.41-5· amd64 · trixieAffected · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41-5· arm64 · trixieAffected · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41.5-0+deb13u1· amd64 · trixie-securityFixed · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41.5-0+deb13u1· arm64 · trixie-securityFixed · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
- [lastlog2]Affected
Source package: [util-linux]
Details (4)
2.41-5· amd64 · trixieAffected · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41-5· arm64 · trixieAffected · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41.5-0+deb13u1· amd64 · trixie-securityFixed · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41.5-0+deb13u1· arm64 · trixie-securityFixed · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
- [libblkid1]Affected
Source package: [util-linux]
Details (4)
2.41-5· amd64 · trixieAffected · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41-5· arm64 · trixieAffected · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41.5-0+deb13u1· amd64 · trixie-securityFixed · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41.5-0+deb13u1· arm64 · trixie-securityFixed · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
- [libblkid-dev]Affected
Source package: [util-linux]
Details (4)
2.41-5· amd64 · trixieAffected · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41-5· arm64 · trixieAffected · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41.5-0+deb13u1· amd64 · trixie-securityFixed · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41.5-0+deb13u1· arm64 · trixie-securityFixed · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
- [libfdisk1]Affected
Source package: [util-linux]
Details (4)
2.41-5· amd64 · trixieAffected · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41-5· arm64 · trixieAffected · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41.5-0+deb13u1· amd64 · trixie-securityFixed · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41.5-0+deb13u1· arm64 · trixie-securityFixed · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
- [libfdisk-dev]Affected
Source package: [util-linux]
Details (4)
2.41-5· amd64 · trixieAffected · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41-5· arm64 · trixieAffected · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41.5-0+deb13u1· amd64 · trixie-securityFixed · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41.5-0+deb13u1· arm64 · trixie-securityFixed · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
- [liblastlog2-2]Affected
Source package: [util-linux]
Details (4)
2.41-5· amd64 · trixieAffected · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41-5· arm64 · trixieAffected · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41.5-0+deb13u1· amd64 · trixie-securityFixed · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41.5-0+deb13u1· arm64 · trixie-securityFixed · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
- [liblastlog2-dev]Affected
Source package: [util-linux]
Details (4)
2.41-5· amd64 · trixieAffected · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41-5· arm64 · trixieAffected · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41.5-0+deb13u1· amd64 · trixie-securityFixed · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41.5-0+deb13u1· arm64 · trixie-securityFixed · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
- [libmount1]Affected
Source package: [util-linux]
Details (4)
2.41-5· amd64 · trixieAffected · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41-5· arm64 · trixieAffected · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41.5-0+deb13u1· amd64 · trixie-securityFixed · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41.5-0+deb13u1· arm64 · trixie-securityFixed · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
- [libmount-dev]Affected
Source package: [util-linux]
Details (4)
2.41-5· amd64 · trixieAffected · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41-5· arm64 · trixieAffected · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41.5-0+deb13u1· amd64 · trixie-securityFixed · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41.5-0+deb13u1· arm64 · trixie-securityFixed · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
- [libpam-lastlog2]Affected
Source package: [util-linux]
Details (4)
2.41-5· amd64 · trixieAffected · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41-5· arm64 · trixieAffected · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41.5-0+deb13u1· amd64 · trixie-securityFixed · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41.5-0+deb13u1· arm64 · trixie-securityFixed · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
- [libsmartcols1]Affected
Source package: [util-linux]
Details (4)
2.41-5· amd64 · trixieAffected · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41-5· arm64 · trixieAffected · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41.5-0+deb13u1· amd64 · trixie-securityFixed · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41.5-0+deb13u1· arm64 · trixie-securityFixed · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
- [libsmartcols-dev]Affected
Source package: [util-linux]
Details (4)
2.41-5· amd64 · trixieAffected · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41-5· arm64 · trixieAffected · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41.5-0+deb13u1· amd64 · trixie-securityFixed · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41.5-0+deb13u1· arm64 · trixie-securityFixed · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
- [libuuid1]Affected
Source package: [util-linux]
Details (4)
2.41-5· amd64 · trixieAffected · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41-5· arm64 · trixieAffected · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41.5-0+deb13u1· amd64 · trixie-securityFixed · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41.5-0+deb13u1· arm64 · trixie-securityFixed · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
- [login]Affected
Source package: [util-linux]
Details (4)
1:4.16.0-2+really2.41-5· amd64 · trixieAffected · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
1:4.16.0-2+really2.41-5· arm64 · trixieAffected · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
1:4.16.0-2+really2.41.5-0+deb13u1· amd64 · trixie-securityFixed · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
1:4.16.0-2+really2.41.5-0+deb13u1· arm64 · trixie-securityFixed · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
- [mount]Affected
Source package: [util-linux]
Details (4)
2.41-5· amd64 · trixieAffected · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41-5· arm64 · trixieAffected · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41.5-0+deb13u1· amd64 · trixie-securityFixed · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41.5-0+deb13u1· arm64 · trixie-securityFixed · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
- [rfkill]Affected
Source package: [util-linux]
Details (4)
2.41-5· amd64 · trixieAffected · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41-5· arm64 · trixieAffected · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41.5-0+deb13u1· amd64 · trixie-securityFixed · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
2.41.5-0+deb13u1· arm64 · trixie-securityFixed · Fixed:
2.41.5-0+deb13u1usn · util-linux · debian · 13
Observed:
References
- [https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_23250-1.json]
- [https://nvd.nist.gov/vuln/detail/CVE-2026-53614]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2026-53614]
- [https://security-tracker.debian.org/tracker/CVE-2026-53614]
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53614.json]
- [https://ubuntu.com/security/notices/USN-8702-1]
- [https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-2938.json]
[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]