util-linux up to 2.41.3 /usr/bin/mount fork link following

Summaryinfo

A vulnerability described as critical has been identified in util-linux up to 2.41.3. This affects the function fork of the file /usr/bin/mount. Such manipulation leads to link following. This vulnerability is referenced as CVE-2026-27456. The attack can only be performed from a local environment. No exploit is available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in util-linux up to 2.41.3. It has been rated as problematic. Affected by this issue is the function fork of the file /usr/bin/mount. The manipulation with an unknown input leads to a link following vulnerability. Using CWE to declare the problem leads to CWE-59. The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource. Impacted is confidentiality. CVE summarizes:

util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-27456 since 02/19/2026. The exploitation is known to be difficult. The attack needs to be approached locally. There are known technical details, but no exploit is available.

Upgrading to version 2.41.4 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 5e390467b26a3cf3fecc04e1a0d482dff3162fc4 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Name

• util-linux

Version

• 2.41.0
• 2.41.1
• 2.41.2
• 2.41.3

License

• open-source

Website

• Product: https://github.com/util-linux/util-linux/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion