Vulnerability-Lookup

RHSA-2026:63162

Vulnerability from csaf_redhat - Published: 2026-09-03 12:46 - Updated: 2026-09-06 07:28

Summary

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Severity

Important

Notes

Topic: An update for Red Hat Hardened Images RPMs is now available.

Details: This update includes the following RPMs: util-linux: * libblkid-2.42.2-3.4.hum1 (aarch64, x86_64) * libblkid-devel-2.42.2-3.4.hum1 (aarch64, x86_64) * libfdisk-2.42.2-3.4.hum1 (aarch64, x86_64) * libfdisk-devel-2.42.2-3.4.hum1 (aarch64, x86_64) * liblastlog2-2.42.2-3.4.hum1 (aarch64, x86_64) * liblastlog2-devel-2.42.2-3.4.hum1 (aarch64, x86_64) * libmount-2.42.2-3.4.hum1 (aarch64, x86_64) * libmount-devel-2.42.2-3.4.hum1 (aarch64, x86_64) * libsmartcols-2.42.2-3.4.hum1 (aarch64, x86_64) * libsmartcols-devel-2.42.2-3.4.hum1 (aarch64, x86_64) * libuuid-2.42.2-3.4.hum1 (aarch64, x86_64) * libuuid-devel-2.42.2-3.4.hum1 (aarch64, x86_64) * python3-libmount-2.42.2-3.4.hum1 (aarch64, x86_64) * util-linux-2.42.2-3.4.hum1 (aarch64, x86_64) * util-linux-core-2.42.2-3.4.hum1 (aarch64, x86_64) * util-linux-i18n-2.42.2-3.4.hum1 (aarch64, x86_64) * util-linux-script-2.42.2-3.4.hum1 (aarch64, x86_64) * uuidd-2.42.2-3.4.hum1 (aarch64, x86_64) * util-linux-2.42.2-3.4.hum1.src (src) Security Fix(es): util-linux: * CVE-2026-76642 * CVE-2026-78408 * CVE-2026-78409 * CVE-2026-78410

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2026-76642

When an external mount.<type> helper runs but exits with a nonzero status, libmount still treats the helper invocation as successful and runs privileged post-mount hooks. A local unprivileged user with an /etc/fstab entry that uses the user option together with X-mount.idmap or X-mount.owner/group/mode can cause those hooks to clone or re-own the underlying filesystem after the helper fails, leading to local privilege escalation.

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-390 - Detection of Error Condition Without Action

Affected products

Fixed 3 products

Product	Version	Remediation
Unresolved product id: Red Hat Hardened Images:util-linux-main@aarch64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:util-linux-main@src	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:util-linux-main@x86_64	—	Vendor Fix fix Workaround

Threats

Impact Important

CVE-2026-78408

The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes.

7.9 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H

CWE-775 - Missing Release of File Descriptor or Handle after Effective Lifetime

Affected products

Fixed 3 products

Product	Version	Remediation
Unresolved product id: Red Hat Hardened Images:util-linux-main@aarch64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:util-linux-main@src	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:util-linux-main@x86_64	—	Vendor Fix fix Workaround

Threats

Impact Important

CVE-2026-78409

The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.

7.0 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-59 - Improper Link Resolution Before File Access ('Link Following')

Affected products

Fixed 3 products

Product	Version	Remediation
Unresolved product id: Red Hat Hardened Images:util-linux-main@aarch64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:util-linux-main@src	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:util-linux-main@x86_64	—	Vendor Fix fix Workaround

Threats

Impact Important

CVE-2026-78410

A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

Affected products

Fixed 3 products

Product	Version	Remediation
Unresolved product id: Red Hat Hardened Images:util-linux-main@aarch64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:util-linux-main@src	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:util-linux-main@x86_64	—	Vendor Fix fix Workaround

Threats

Impact Important

References

28 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:63162	self
https://access.redhat.com/security/cve/CVE-2026-76642	external
https://access.redhat.com/security/cve/CVE-2026-78408	external
https://access.redhat.com/security/cve/CVE-2026-78409	external
https://access.redhat.com/security/cve/CVE-2026-78410	external
https://access.redhat.com/security/updates/classi…	external
https://images.redhat.com/	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2026-76642	self
https://bugzilla.redhat.com/show_bug.cgi?id=2521999	external
https://www.cve.org/CVERecord?id=CVE-2026-76642	external
https://nvd.nist.gov/vuln/detail/CVE-2026-76642	external
https://github.com/util-linux/util-linux/security…	external
https://access.redhat.com/security/cve/CVE-2026-78408	self
https://bugzilla.redhat.com/show_bug.cgi?id=2522497	external
https://www.cve.org/CVERecord?id=CVE-2026-78408	external
https://nvd.nist.gov/vuln/detail/CVE-2026-78408	external
https://github.com/util-linux/util-linux/security…	external
https://access.redhat.com/security/cve/CVE-2026-78409	self
https://bugzilla.redhat.com/show_bug.cgi?id=2522607	external
https://www.cve.org/CVERecord?id=CVE-2026-78409	external
https://nvd.nist.gov/vuln/detail/CVE-2026-78409	external
https://github.com/util-linux/util-linux/security…	external
https://access.redhat.com/security/cve/CVE-2026-78410	self
https://bugzilla.redhat.com/show_bug.cgi?id=2522684	external
https://www.cve.org/CVERecord?id=CVE-2026-78410	external
https://nvd.nist.gov/vuln/detail/CVE-2026-78410	external
https://github.com/util-linux/util-linux/security…	external

Acknowledgments

Independent Security Researcher Iván Redondo Plaza Andreas Gabriel Berbescu

Independent Security Researcher Andreas Gabriel Berbescu

Huawei Cloud Zhuorao Yang

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for Red Hat Hardened Images RPMs is now available.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This update includes the following RPMs:\n\nutil-linux:\n  * libblkid-2.42.2-3.4.hum1 (aarch64, x86_64)\n  * libblkid-devel-2.42.2-3.4.hum1 (aarch64, x86_64)\n  * libfdisk-2.42.2-3.4.hum1 (aarch64, x86_64)\n  * libfdisk-devel-2.42.2-3.4.hum1 (aarch64, x86_64)\n  * liblastlog2-2.42.2-3.4.hum1 (aarch64, x86_64)\n  * liblastlog2-devel-2.42.2-3.4.hum1 (aarch64, x86_64)\n  * libmount-2.42.2-3.4.hum1 (aarch64, x86_64)\n  * libmount-devel-2.42.2-3.4.hum1 (aarch64, x86_64)\n  * libsmartcols-2.42.2-3.4.hum1 (aarch64, x86_64)\n  * libsmartcols-devel-2.42.2-3.4.hum1 (aarch64, x86_64)\n  * libuuid-2.42.2-3.4.hum1 (aarch64, x86_64)\n  * libuuid-devel-2.42.2-3.4.hum1 (aarch64, x86_64)\n  * python3-libmount-2.42.2-3.4.hum1 (aarch64, x86_64)\n  * util-linux-2.42.2-3.4.hum1 (aarch64, x86_64)\n  * util-linux-core-2.42.2-3.4.hum1 (aarch64, x86_64)\n  * util-linux-i18n-2.42.2-3.4.hum1 (aarch64, x86_64)\n  * util-linux-script-2.42.2-3.4.hum1 (aarch64, x86_64)\n  * uuidd-2.42.2-3.4.hum1 (aarch64, x86_64)\n  * util-linux-2.42.2-3.4.hum1.src (src)\n\nSecurity Fix(es):\n\nutil-linux:\n  * CVE-2026-76642\n  * CVE-2026-78408\n  * CVE-2026-78409\n  * CVE-2026-78410",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:63162",
        "url": "https://access.redhat.com/errata/RHSA-2026:63162"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-76642",
        "url": "https://access.redhat.com/security/cve/CVE-2026-76642"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-78408",
        "url": "https://access.redhat.com/security/cve/CVE-2026-78408"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-78409",
        "url": "https://access.redhat.com/security/cve/CVE-2026-78409"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-78410",
        "url": "https://access.redhat.com/security/cve/CVE-2026-78410"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://images.redhat.com/",
        "url": "https://images.redhat.com/"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_63162.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
    "tracking": {
      "current_release_date": "2026-09-06T07:28:06+00:00",
      "generator": {
        "date": "2026-09-06T07:28:06+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.16"
        }
      },
      "id": "RHSA-2026:63162",
      "initial_release_date": "2026-09-03T12:46:16+00:00",
      "revision_history": [
        {
          "date": "2026-09-03T12:46:16+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-09-04T00:36:24+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-09-06T07:28:06+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Hardened Images",
                "product": {
                  "name": "Red Hat Hardened Images",
                  "product_id": "Red Hat Hardened Images",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:hummingbird:1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Hardened Images"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "util-linux-main@aarch64",
                "product": {
                  "name": "util-linux-main@aarch64",
                  "product_id": "util-linux-main@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libblkid@2.42.2-3.4.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "util-linux-main@x86_64",
                "product": {
                  "name": "util-linux-main@x86_64",
                  "product_id": "util-linux-main@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libblkid@2.42.2-3.4.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "util-linux-main@src",
                "product": {
                  "name": "util-linux-main@src",
                  "product_id": "util-linux-main@src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/util-linux@2.42.2-3.4.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "util-linux-main@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:util-linux-main@aarch64"
        },
        "product_reference": "util-linux-main@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "util-linux-main@src as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:util-linux-main@src"
        },
        "product_reference": "util-linux-main@src",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "util-linux-main@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:util-linux-main@x86_64"
        },
        "product_reference": "util-linux-main@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Iv\u00e1n Redondo Plaza",
            "Andreas Gabriel Berbescu"
          ],
          "organization": "Independent Security Researcher"
        }
      ],
      "cve": "CVE-2026-76642",
      "cwe": {
        "id": "CWE-390",
        "name": "Detection of Error Condition Without Action"
      },
      "discovery_date": "2026-07-20T13:07:27+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2521999"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "When an external mount.\u003ctype\u003e helper runs but exits with a nonzero status, libmount still treats the helper invocation as successful and runs privileged post-mount hooks. A local unprivileged user with an /etc/fstab entry that uses the user option together with X-mount.idmap or X-mount.owner/group/mode can cause those hooks to clone or re-own the underlying filesystem after the helper fails, leading to local privilege escalation.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "util-linux: util-linux: failed external mount helper still runs privileged X-mount post-hooks",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Affected versions: util-linux v2.39 through v2.42.2. Fixed in v2.41.6 and v2.42.3.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:util-linux-main@aarch64",
          "Red Hat Hardened Images:util-linux-main@src",
          "Red Hat Hardened Images:util-linux-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-76642"
        },
        {
          "category": "external",
          "summary": "RHBZ#2521999",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2521999"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-76642",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-76642"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-76642",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76642"
        },
        {
          "category": "external",
          "summary": "https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f",
          "url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f"
        }
      ],
      "release_date": "2026-09-02T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-03T12:46:16+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:util-linux-main@aarch64",
            "Red Hat Hardened Images:util-linux-main@src",
            "Red Hat Hardened Images:util-linux-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:63162"
        },
        {
          "category": "workaround",
          "details": "Upgrade to util-linux v2.41.6, v2.42.3, or later. Until a fix is applied, avoid combining the user (or users) fstab option with X-mount.idmap or X-mount.owner/group/mode on entries that invoke an external mount.\u003ctype\u003e helper. Administrators can also remove or restrict user-mountable fstab entries that specify those X-mount.* options.",
          "product_ids": [
            "Red Hat Hardened Images:util-linux-main@aarch64",
            "Red Hat Hardened Images:util-linux-main@src",
            "Red Hat Hardened Images:util-linux-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:util-linux-main@aarch64",
            "Red Hat Hardened Images:util-linux-main@src",
            "Red Hat Hardened Images:util-linux-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "util-linux: util-linux: failed external mount helper still runs privileged X-mount post-hooks"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Andreas Gabriel Berbescu"
          ],
          "organization": "Independent Security Researcher"
        }
      ],
      "cve": "CVE-2026-78408",
      "cwe": {
        "id": "CWE-775",
        "name": "Missing Release of File Descriptor or Handle after Effective Lifetime"
      },
      "discovery_date": "2026-07-26T09:22:21+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2522497"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root\u0027s ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Affected versions: util-linux v2.40 through v2.42.2. The --join-cgroup option was introduced in v2.40; earlier releases (including util-linux 2.38) are not affected. Fixed in v2.41.6 and v2.42.3.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:util-linux-main@aarch64",
          "Red Hat Hardened Images:util-linux-main@src",
          "Red Hat Hardened Images:util-linux-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-78408"
        },
        {
          "category": "external",
          "summary": "RHBZ#2522497",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2522497"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-78408",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-78408"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-78408",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-78408"
        },
        {
          "category": "external",
          "summary": "https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj",
          "url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj"
        }
      ],
      "release_date": "2026-09-02T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-03T12:46:16+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:util-linux-main@aarch64",
            "Red Hat Hardened Images:util-linux-main@src",
            "Red Hat Hardened Images:util-linux-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:63162"
        },
        {
          "category": "workaround",
          "details": "Upgrade to util-linux v2.41.6, v2.42.3, or later. Until a fix is applied, do not run nsenter --join-cgroup (including nsenter --target PID --all --join-cgroup) against untrusted processes or namespaces. The fix closes the cgroup.procs descriptor immediately after joining, and opens it with O_CLOEXEC.",
          "product_ids": [
            "Red Hat Hardened Images:util-linux-main@aarch64",
            "Red Hat Hardened Images:util-linux-main@src",
            "Red Hat Hardened Images:util-linux-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.9,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:util-linux-main@aarch64",
            "Red Hat Hardened Images:util-linux-main@src",
            "Red Hat Hardened Images:util-linux-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Zhuorao Yang"
          ],
          "organization": "Huawei Cloud",
          "summary": "Acknowledged by upstream."
        }
      ],
      "cve": "CVE-2026-78409",
      "cwe": {
        "id": "CWE-59",
        "name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
      },
      "discovery_date": "2026-06-17T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2522607"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "util-linux: util-linux: X-mount.subdir detached-tree resolution can escape via intermediate symlinks",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Affected versions: util-linux v2.42 through v2.42.2. The Linux \u003e= 6.15 detached-tree X-mount.subdir fast path was introduced in ae19f7546ccb (2025-04-15) and first released in v2.42. Earlier releases, including v2.40 and v2.41, are not affected. Restricted-user SUID mount(8) reproduction also requires Linux \u003e= 6.15. Fixed in v2.41.6 and v2.42.3.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:util-linux-main@aarch64",
          "Red Hat Hardened Images:util-linux-main@src",
          "Red Hat Hardened Images:util-linux-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-78409"
        },
        {
          "category": "external",
          "summary": "RHBZ#2522607",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2522607"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-78409",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-78409"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-78409",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-78409"
        },
        {
          "category": "external",
          "summary": "https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv",
          "url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv"
        }
      ],
      "release_date": "2026-09-02T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-03T12:46:16+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:util-linux-main@aarch64",
            "Red Hat Hardened Images:util-linux-main@src",
            "Red Hat Hardened Images:util-linux-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:63162"
        },
        {
          "category": "workaround",
          "details": "Upgrade to util-linux v2.41.6, v2.42.3, or later. Until a fix is applied, do not allow unprivileged /etc/fstab entries that specify X-mount.subdir.",
          "product_ids": [
            "Red Hat Hardened Images:util-linux-main@aarch64",
            "Red Hat Hardened Images:util-linux-main@src",
            "Red Hat Hardened Images:util-linux-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.0,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:util-linux-main@aarch64",
            "Red Hat Hardened Images:util-linux-main@src",
            "Red Hat Hardened Images:util-linux-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "util-linux: util-linux: X-mount.subdir detached-tree resolution can escape via intermediate symlinks"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Zhuorao Yang"
          ],
          "organization": "Huawei Cloud",
          "summary": "Acknowledged by upstream."
        }
      ],
      "cve": "CVE-2026-78410",
      "cwe": {
        "id": "CWE-367",
        "name": "Time-of-check Time-of-use (TOCTOU) Race Condition"
      },
      "discovery_date": "2026-06-18T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2522684"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "util-linux: util-linux: restricted bind mounts do not pin the source, allowing X-mount.owner/group/mode redirection",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Affected versions: util-linux v2.39 through v2.42.2. X-mount.owner/group/mode was introduced in v2.39; earlier releases are not affected. Fixed in v2.41.6 and v2.42.3.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:util-linux-main@aarch64",
          "Red Hat Hardened Images:util-linux-main@src",
          "Red Hat Hardened Images:util-linux-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-78410"
        },
        {
          "category": "external",
          "summary": "RHBZ#2522684",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2522684"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-78410",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-78410"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-78410",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-78410"
        },
        {
          "category": "external",
          "summary": "https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m",
          "url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m"
        }
      ],
      "release_date": "2026-09-02T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-03T12:46:16+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:util-linux-main@aarch64",
            "Red Hat Hardened Images:util-linux-main@src",
            "Red Hat Hardened Images:util-linux-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:63162"
        },
        {
          "category": "workaround",
          "details": "Upgrade to util-linux v2.41.6, v2.42.3, or later. Until a fix is applied, do not allow unprivileged /etc/fstab bind or rbind entries that also specify X-mount.owner, X-mount.group, or X-mount.mode, especially when the bind source is below a user-writable ancestor.",
          "product_ids": [
            "Red Hat Hardened Images:util-linux-main@aarch64",
            "Red Hat Hardened Images:util-linux-main@src",
            "Red Hat Hardened Images:util-linux-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:util-linux-main@aarch64",
            "Red Hat Hardened Images:util-linux-main@src",
            "Red Hat Hardened Images:util-linux-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "util-linux: util-linux: restricted bind mounts do not pin the source, allowing X-mount.owner/group/mode redirection"
    }
  ]
}

CVE-2026-76642 (GCVE-0-2026-76642)

Vulnerability from cvelistv5 – Published: 2026-09-03 10:54 – Updated: 2026-09-03 14:00

Title

util-linux libmount Privilege Escalation via Failed Mount Helper

Summary

util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.

Severity

8.5 (High)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-03 14:00 UTC

CWE

CWE-390 - Detection of Error Condition Without Action

Assigner

VulnCheck mitre root

References

8 references

URL	Tags
https://github.com/util-linux/util-linux/security…	vendor-advisory
https://github.com/util-linux/util-linux/commit/f…	patch
https://github.com/util-linux/util-linux/commit/1…	patch
https://github.com/util-linux/util-linux/commit/a…	patch
https://github.com/util-linux/util-linux/blob/v2.…	technical-description
https://github.com/util-linux/util-linux/blob/v2.…	technical-description
https://github.com/util-linux/util-linux	product
https://www.vulncheck.com/advisories/util-linux-l…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
util-linux	util-linux	Affected: 2.39 , < 2.41.6 (custom) Affected: 2.42 , < 2.42.3 (custom) cpe:2.3:a:kernel:util-linux:::::::: cpe:2.3:a:kernel:util-linux::::::::

Date Public

2026-09-02 00:00

Credits

Andreas Gabriel Berbescu Ivan Redondo Plaza

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-76642",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-03T14:00:22.814411Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-03T14:00:29.374Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/util-linux/util-linux",
          "product": "util-linux",
          "vendor": "util-linux",
          "versions": [
            {
              "lessThan": "2.41.6",
              "status": "affected",
              "version": "2.39",
              "versionType": "custom"
            },
            {
              "lessThan": "2.42.3",
              "status": "affected",
              "version": "2.42",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:kernel:util-linux:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.41.6",
                  "versionStartIncluding": "2.39",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:kernel:util-linux:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.42.3",
                  "versionStartIncluding": "2.42",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Andreas Gabriel Berbescu"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Ivan Redondo Plaza"
        }
      ],
      "datePublic": "2026-09-02T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-390",
              "description": "Detection of Error Condition Without Action",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-03T10:54:08.150Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-m25x-3hj9-m26f)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f"
        },
        {
          "name": "Patch Commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf"
        },
        {
          "name": "Patch Commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a"
        },
        {
          "name": "Patch Commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/util-linux/util-linux"
        },
        {
          "name": "VulnCheck Advisory: util-linux libmount Privilege Escalation via Failed Mount Helper",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper"
        }
      ],
      "title": "util-linux libmount Privilege Escalation via Failed Mount Helper",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-76642",
    "datePublished": "2026-09-03T10:54:08.150Z",
    "dateReserved": "2026-08-19T14:53:58.575Z",
    "dateUpdated": "2026-09-03T14:00:29.374Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-78408 (GCVE-0-2026-78408)

Vulnerability from cvelistv5 – Published: 2026-09-02 15:05 – Updated: 2026-09-05 13:06

Title

Util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority

Summary

Severity

7.9 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-04 02:32 UTC

CWE

CWE-775 - Missing Release of File Descriptor or Handle after Effective Lifetime

Assigner

redhat redhat root

References

5 references

URL	Tags
https://access.redhat.com/errata/RHSA-2026:63162	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2026-78408	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2522497	issue-trackingx_refsource_REDHAT
https://github.com/util-linux/util-linux/security…
http://www.openwall.com/lists/oss-security/2026/09/05/2

Impacted products

6 products

Vendor	Product	Version
Red Hat	Red Hat Hardened Images	Unaffected: 2.42.2-3.4.hum1 , < * (rpm) cpe:/a:redhat:hummingbird:1
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat OpenShift Container Platform 4	cpe:/a:redhat:openshift:4

Date Public

2026-09-02 00:00

Credits

Red Hat would like to thank Andreas Gabriel Berbescu (Independent Security Researcher) for reporting this issue.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-78408",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-04T02:32:17.411553Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-04T02:32:41.535Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2026-09-05T13:06:53.205Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/09/05/2"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:hummingbird:1"
          ],
          "defaultStatus": "affected",
          "packageName": "util-linux-main",
          "product": "Red Hat Hardened Images",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2.42.2-3.4.hum1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "affected",
          "packageName": "util-linux",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:7"
          ],
          "defaultStatus": "unaffected",
          "packageName": "util-linux",
          "product": "Red Hat Enterprise Linux 7",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "unaffected",
          "packageName": "util-linux",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "unaffected",
          "packageName": "rhel8/flatpak-runtime",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "unaffected",
          "packageName": "rhel8/flatpak-sdk",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "unaffected",
          "packageName": "util-linux",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "unaffected",
          "packageName": "rhcos",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank Andreas Gabriel Berbescu (Independent Security Researcher) for reporting this issue."
        }
      ],
      "datePublic": "2026-09-02T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root\u0027s ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Important"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.9,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-775",
              "description": "Missing Release of File Descriptor or Handle after Effective Lifetime",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-03T12:50:51.689Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2026:63162",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:63162"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-78408"
        },
        {
          "name": "RHBZ#2522497",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2522497"
        },
        {
          "url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-07-26T09:22:21.000Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-09-02T00:00:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "Util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority",
      "workarounds": [
        {
          "lang": "en",
          "value": "Upgrade to util-linux v2.41.6, v2.42.3, or later. Until a fix is applied, do not run nsenter --join-cgroup (including nsenter --target PID --all --join-cgroup) against untrusted processes or namespaces. The fix closes the cgroup.procs descriptor immediately after joining, and opens it with O_CLOEXEC."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-775: Missing Release of File Descriptor or Handle after Effective Lifetime"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-78408",
    "datePublished": "2026-09-02T15:05:33.555Z",
    "dateReserved": "2026-08-24T14:40:14.511Z",
    "dateUpdated": "2026-09-05T13:06:53.205Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-78409 (GCVE-0-2026-78409)

Vulnerability from cvelistv5 – Published: 2026-09-02 15:11 – Updated: 2026-09-03 12:50

Title

Util-linux: util-linux: x-mount.subdir detached-tree resolution can escape via intermediate symlinks

Summary

Severity

7 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-02 15:29 UTC

CWE

CWE-59 - Improper Link Resolution Before File Access ('Link Following')

Assigner

redhat redhat root

References

4 references

URL	Tags
https://access.redhat.com/errata/RHSA-2026:63162	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2026-78409	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2522607	issue-trackingx_refsource_REDHAT
https://github.com/util-linux/util-linux/security…

Impacted products

6 products

Vendor	Product	Version
Red Hat	Red Hat Hardened Images	Unaffected: 2.42.2-3.4.hum1 , < * (rpm) cpe:/a:redhat:hummingbird:1
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat OpenShift Container Platform 4	cpe:/a:redhat:openshift:4

Date Public

2026-09-02 00:00

Credits

Upstream acknowledges Zhuorao Yang (Huawei Cloud) as the original reporter.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-78409",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-02T15:29:06.011028Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-02T15:31:33.985Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:hummingbird:1"
          ],
          "defaultStatus": "affected",
          "packageName": "util-linux-main",
          "product": "Red Hat Hardened Images",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2.42.2-3.4.hum1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "unaffected",
          "packageName": "util-linux",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:7"
          ],
          "defaultStatus": "unaffected",
          "packageName": "util-linux",
          "product": "Red Hat Enterprise Linux 7",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "unaffected",
          "packageName": "util-linux",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "unaffected",
          "packageName": "rhel8/flatpak-runtime",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "unaffected",
          "packageName": "rhel8/flatpak-sdk",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "unaffected",
          "packageName": "util-linux",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "unaffected",
          "packageName": "rhcos",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Upstream acknowledges Zhuorao Yang (Huawei Cloud) as the original reporter."
        }
      ],
      "datePublic": "2026-09-02T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Important"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-59",
              "description": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-03T12:50:56.499Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2026:63162",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:63162"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-78409"
        },
        {
          "name": "RHBZ#2522607",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2522607"
        },
        {
          "url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-06-17T00:00:00.000Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-09-02T00:00:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "Util-linux: util-linux: x-mount.subdir detached-tree resolution can escape via intermediate symlinks",
      "workarounds": [
        {
          "lang": "en",
          "value": "Upgrade to util-linux v2.41.6, v2.42.3, or later. Until a fix is applied, do not allow unprivileged /etc/fstab entries that specify X-mount.subdir."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-78409",
    "datePublished": "2026-09-02T15:11:47.184Z",
    "dateReserved": "2026-08-24T14:40:18.012Z",
    "dateUpdated": "2026-09-03T12:50:56.499Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-78410 (GCVE-0-2026-78410)

Vulnerability from cvelistv5 – Published: 2026-09-02 15:05 – Updated: 2026-09-04 18:43

Title

Util-linux: util-linux: restricted bind mounts do not pin the source, allowing x-mount.owner/group/mode redirection

Summary

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-04 18:43 UTC

CWE

CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

Assigner

redhat redhat root

References

4 references

URL	Tags
https://access.redhat.com/errata/RHSA-2026:63162	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2026-78410	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2522684	issue-trackingx_refsource_REDHAT
https://github.com/util-linux/util-linux/security…

Impacted products

6 products

Vendor	Product	Version
Red Hat	Red Hat Hardened Images	Unaffected: 2.42.2-3.4.hum1 , < * (rpm) cpe:/a:redhat:hummingbird:1
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat OpenShift Container Platform 4	cpe:/a:redhat:openshift:4

Date Public

2026-09-02 00:00

Credits

Upstream acknowledges Zhuorao Yang (Huawei Cloud) as the original reporter.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-78410",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-04T18:43:04.874138Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-04T18:43:10.663Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:hummingbird:1"
          ],
          "defaultStatus": "affected",
          "packageName": "util-linux-main",
          "product": "Red Hat Hardened Images",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2.42.2-3.4.hum1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "affected",
          "packageName": "util-linux",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:7"
          ],
          "defaultStatus": "unaffected",
          "packageName": "util-linux",
          "product": "Red Hat Enterprise Linux 7",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "unaffected",
          "packageName": "util-linux",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "unaffected",
          "packageName": "rhel8/flatpak-runtime",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "unaffected",
          "packageName": "rhel8/flatpak-sdk",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "unaffected",
          "packageName": "util-linux",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "unaffected",
          "packageName": "rhcos",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Upstream acknowledges Zhuorao Yang (Huawei Cloud) as the original reporter."
        }
      ],
      "datePublic": "2026-09-02T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Important"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-367",
              "description": "Time-of-check Time-of-use (TOCTOU) Race Condition",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-03T12:51:01.307Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2026:63162",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:63162"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-78410"
        },
        {
          "name": "RHBZ#2522684",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2522684"
        },
        {
          "url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-06-18T00:00:00.000Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-09-02T00:00:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "Util-linux: util-linux: restricted bind mounts do not pin the source, allowing x-mount.owner/group/mode redirection",
      "workarounds": [
        {
          "lang": "en",
          "value": "Upgrade to util-linux v2.41.6, v2.42.3, or later. Until a fix is applied, do not allow unprivileged /etc/fstab bind or rbind entries that also specify X-mount.owner, X-mount.group, or X-mount.mode, especially when the bind source is below a user-writable ancestor."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-78410",
    "datePublished": "2026-09-02T15:05:34.414Z",
    "dateReserved": "2026-08-24T14:40:20.201Z",
    "dateUpdated": "2026-09-04T18:43:10.663Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

RHSA-2026:63162

CVE-2026-76642 (GCVE-0-2026-76642)

CVE-2026-78408 (GCVE-0-2026-78408)

CVE-2026-78409 (GCVE-0-2026-78409)

CVE-2026-78410 (GCVE-0-2026-78410)

Tags

Sightings

Nomenclature