GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

FKIE_CVE-2026-27456

Vulnerability from fkie_nvd - Published: 2026-04-03 22:16 - Updated: 2026-07-24 22:10
Severity
4.7 (Medium) - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Summary
util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.
References
security-advisories@github.comhttps://github.com/util-linux/util-linux/commit/5e390467b26a3cf3fecc04e1a0d482dff3162fc4Patch
security-advisories@github.comhttps://github.com/util-linux/util-linux/releases/tag/v2.41.4Product
security-advisories@github.comhttps://github.com/util-linux/util-linux/security/advisories/GHSA-qq4x-vfq4-9h9gExploit, Vendor Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0https://github.com/util-linux/util-linux/security/advisories/GHSA-qq4x-vfq4-9h9gExploit, Vendor Advisory
Impacted products
Vendor Product Version
kernel util-linux *
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "util-linux",
          "vendor": "util-linux",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.41.4"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:kernel:util-linux:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "A0F464C1-2AC1-4B59-B522-89DD9D072C7F",
              "versionEndExcluding": "2.41.4",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4."
    },
    {
      "lang": "es",
      "value": "util-linux es una colecci\u00f3n aleatoria de utilidades de Linux. Antes de la versi\u00f3n 2.41.4, se ha identificado una vulnerabilidad TOCTOU (Time-of-Check-Time-of-Use) en el binario SUID /usr/bin/mount de util-linux. El binario mount, al configurar dispositivos de bucle, valida la ruta del archivo de origen con privilegios de usuario a trav\u00e9s de fork() + setuid() + realpath(), pero posteriormente la vuelve a canonizar y la abre con privilegios de root (euid=0) sin verificar que la ruta no haya sido reemplazada entre ambas operaciones. No se emplean ni O_NOFOLLOW, ni la comparaci\u00f3n de inodos, ni fstat() posterior a la apertura. Esto permite a un usuario local sin privilegios reemplazar el archivo de origen con un enlace simb\u00f3lico que apunte a cualquier archivo o dispositivo propiedad de root durante la ventana de carrera, haciendo que el binario SUID lo abra y monte como root. La explotaci\u00f3n requiere una entrada en /etc/fstab con las opciones user,loop cuya ruta apunte a un directorio donde el atacante tenga permiso de escritura, y que /usr/bin/mount tenga el bit SUID establecido (la configuraci\u00f3n predeterminada en pr\u00e1cticamente todas las distribuciones de Linux). El impacto es el acceso de lectura no autorizado a archivos protegidos por root y dispositivos de bloque, incluyendo im\u00e1genes de respaldo, vol\u00famenes de disco y cualquier archivo que contenga un sistema de archivos v\u00e1lido. Este problema ha sido parcheado en la versi\u00f3n 2.41.4."
    }
  ],
  "id": "CVE-2026-27456",
  "lastModified": "2026-07-24T22:10:00.140",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "LOCAL",
          "availabilityImpact": "NONE",
          "baseScore": 4.7,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.0,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-27456",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-04-06T15:38:42.794607Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-04-03T22:16:25.400",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/util-linux/util-linux/commit/5e390467b26a3cf3fecc04e1a0d482dff3162fc4"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Product"
      ],
      "url": "https://github.com/util-linux/util-linux/releases/tag/v2.41.4"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-qq4x-vfq4-9h9g"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-qq4x-vfq4-9h9g"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-59"
        },
        {
          "lang": "en",
          "value": "CWE-269"
        },
        {
          "lang": "en",
          "value": "CWE-367"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-367"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.