Description

util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-09-03T13:06:08.440Z",
  "pubdate": "2026-09-03T13:06:08.440Z",
  "executiveSummary": "A critical security vulnerability exists in util-linux versions through 2.41.5 and 2.42.2, involving improper validation of mount helper exit statuses. This flaw allows an unprivileged user to execute privileged operations by circumventing standard mount security checks.\nThe vulnerability stems from the system failing to verify the successful termination of mount helpers before proceeding to execute post-mount hooks. An attacker can leverage this race condition or logic flaw to trigger hooks such as X-mount.idmap or X-mount.owner.\nSuccessful exploitation enables an attacker to manipulate filesystem properties, including the inheritance of SUID bits, or modify target inode permissions on pre-existing filesystems. This can lead to full local privilege escalation, allowing a non-privileged user to gain administrative or root-level control.\nThe attack requires local access to the system and the ability to mount or manipulate filesystems, which is common in environments with broad user access to mount operations. Remediation requires an update to the util-linux package to enforce strict exit-status validation during the mount procedure.",
  "technicalDetails": "The vulnerability in util-linux versions through 2.41.5 and 2.42.2 resides in the mount command implementation, specifically within the logic governing the lifecycle of external mount helpers. The mount utility typically invokes specialized helpers for various filesystem types; however, the component fails to properly validate the exit status returned by these helpers before initiating subsequent post-mount operations.\nIn a secure mount process, the mount utility should terminate execution or abort the mounting process if a helper program exits with a non-zero status, indicating failure or a security violation. Because this verification is absent, the util-linux utility proceeds to execute configured post-mount hooks—specifically X-mount.idmap and X-mount.owner—despite the helper's failure to mount the filesystem as intended.\nThe attack flow begins with an unprivileged user initiating a mount request on a pre-existing filesystem while providing parameters that force a controlled failure within the mount helper. By inducing this failure, the attacker creates a window where the system is in an indeterminate state regarding ownership and permissions.\nExploitation leverages the post-mount hooks while the system is in this failed-but-continuing state. The attacker directs the hook processes to interact with target inodes on the filesystem. Because the hooks operate with elevated privileges, the attacker can manipulate these inodes, specifically applying ID mappings or ownership changes that would otherwise be restricted.\nA primary objective for an attacker is the manipulation of the SUID bit on files or the modification of target inode permissions to grant the attacker write access to sensitive system files. By using the X-mount.idmap hook, the attacker can effectively 'remap' the user identity associated with the filesystem's contents, causing inherited SUID bits to manifest for the attacker's UID. This allows for the execution of binaries with permissions superior to the attacker's original unprivileged state.\nThe vulnerability is localized to the util-linux mount implementation. Since it operates at the kernel-user interface for filesystem management, it does not require network exposure, but it does necessitate local system access. No authentication is required beyond the ability to invoke mount, which is frequently permitted for unprivileged users on many Linux distributions via /etc/fstab or user-namespace features. Post-exploitation impact includes full system compromise, as the attacker can manipulate binary ownership or permissions to transition from local unprivileged status to full administrative control."
}