CVE-2026-78410 in Red Hat
Summary
by MITRE • 09/02/2026
A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/02/2026
The vulnerability identified in util-linux represents a critical security flaw within the implementation of restricted bind mounts, specifically affecting how the system handles source path resolution and privilege escalation during mount operations. This issue stems from a race condition inherent in the sequence of operations performed by the privileged mount binary when processing entries defined in the fstab configuration file. When an unprivileged user triggers a bind mount operation that is permitted under specific restrictions, the utility retrieves the source path for the mount point directly from the fstab entry rather than resolving and locking it at the time of permission validation. This architectural decision creates a window of opportunity where the filesystem state can be altered between the initial authorization check and the actual execution of the privileged system call to perform the bind mount.
The core technical flaw lies in the lack of path pinning for the source directory before the elevated privileges are invoked. In a secure implementation, once an unprivileged user is granted permission to mount a specific resource, that resource should be locked or pinned to prevent any subsequent modifications by other processes or users until the operation completes. However, because util-linux does not enforce this lock, a local unprivileged attacker who has write access to the authorized source path or even a writable ancestor directory can manipulate the filesystem structure during this interval. By replacing the original file or directory with a symbolic link pointing to an arbitrary location on the host system, the attacker effectively hijacks the mount operation. The SUID mount binary, operating with root privileges, then proceeds to bind-mount whatever target is currently at that path, which may be a sensitive system directory such as /etc/shadow or other critical configuration files.
The operational impact of this vulnerability is severe, allowing for local privilege escalation from an unprivileged user account to the root level. If the fstab entry includes specific mount options designed to restrict access further, such as X-mount.owner, X-mount.group, or X-mount.mode, these settings are applied after the bind operation has already been redirected by the attacker. Consequently, when the privileged process applies these ownership and permission changes to the newly bound inode, it inadvertently grants the attacker control over a critical system resource with elevated permissions. For instance, if an attacker redirects the mount to /etc/shadow and sets X-mount.mode to allow world-readable access or modifies ownership to their own user ID, they can subsequently read sensitive authentication data or manipulate file attributes that should be strictly protected by root privileges. This mechanism bypasses standard Linux security models including Mandatory Access Control policies like SELinux or AppArmor if those contexts are not explicitly preserved during the mount operation, although the primary vector remains a traditional privilege escalation via filesystem manipulation.
From a classification perspective, this vulnerability aligns with CWE-367, Time-of-check to time-of-use (TOCTOU) race condition, as it exploits the gap between verifying permissions and executing the action. It also relates closely to CWE-22, Improper Limitation of a Pathname to a Restricted Directory, because the attacker leverages writable ancestors or source paths to redirect access outside intended boundaries. In terms of offensive security frameworks, this technique is consistent with MITRE ATT&CK tactic T1068, Exploitation for Privilege Escalation, specifically utilizing methods that involve manipulating system binaries and configuration files to gain higher-level access. The attack requires local physical or shell access but does not necessarily require network exposure, making it a significant threat in multi-user environments where users have write permissions to shared directories or home spaces that intersect with mount paths defined in fstab.
Mitigation strategies must address both the immediate technical flaw and broader configuration practices. The primary remediation is to apply vendor-provided patches for util-linux that enforce path pinning, ensuring that once a source path is validated against access controls, it remains immutable until the mount operation completes. System administrators should audit their fstab configurations to ensure that no unprivileged users have write permissions over directories listed as sources in bind mount entries. Additionally, restricting the use of X-mount.owner and similar options for mounts initiated by non-root processes can reduce the impact if a TOCTOU condition is exploited. Implementing strict filesystem permissions on /etc/fstab itself prevents unauthorized modification of mount definitions, while using SELinux or AppArmor policies to restrict which paths can be bind-mounted further limits the attack surface. Regular updates and patch management are essential to maintain protection against this class of vulnerabilities in Linux-based systems.