Bug 2519647 (CVE-2026-53612)

Summary: CVE-2026-53612 util-linux: util-linux: TOCTOU in the mount program when applying post-mount ownership/mode changes
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: akhatavk, aos-team-art-private, asdas, Daniel.McGovern, dpaolell, gtanzill, jbuscemi, jdelft, jupierce, kshier, lgarciaa, mbiarnes, ppalepu, ppostler, prdhamdh, rhel-process-autobot, sghai, sidsharm, stcannon, suppawar, teagle, vlaad, watson-tool-maintainers, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in util-linux. When an /etc/fstab entry uses the user option together with X-mount.owner, X-mount.group, or X-mount.mode, mount(8) changes ownership or permissions on the mount target after mounting without re-verifying the path. A local unprivileged user can exploit this Time-of-Check-Time-of-Use (TOCTOU) window by swapping the target directory, redirecting the ownership/permission change to an arbitrary file and potentially escalating privileges to root.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-19 14:36:46 UTC 
A race condition exists in util-linux's SUID mount binary (hook_owner.c). When the X-mount.owner, X-mount.group, or X-mount.mode fstab options are set, mount(8) performs a post-mount permission change (lchown()/chmod()) on the mount target path without re-verifying the path still refers to the object that was just mounted. A local unprivileged attacker can use an atomic ancestor directory swap in the window between the mount and the ownership/mode change to redirect the chown/chmod operation to an arbitrary file, gaining control of that file and potentially escalating privileges to root. Exploitation requires an /etc/fstab entry with the user option plus one of X-mount.owner/group/mode, and an ancestor directory writable by the attacker. Introduced in commit 722c96974dd4 (2022-04-19); affects util-linux v2.39 through v2.41.3 (unfixed as of the June 16, 2026 advisory). Reported upstream by Xinyao Hu. GHSA-g8wm-75wr-g2vh.