Bug 2519648 (CVE-2026-53614)

Summary:	CVE-2026-53614 util-linux: util-linux: SUID mount(8) allows nosuid/noexec bypass via LIBMOUNT_FORCE_MOUNT2
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	akhatavk, aos-team-art-private, asdas, Daniel.McGovern, dpaolell, gtanzill, jbuscemi, jdelft, jupierce, kshier, lgarciaa, mbiarnes, ppalepu, ppostler, prdhamdh, rhel-process-autobot, sghai, sidsharm, stcannon, suppawar, teagle, vlaad, watson-tool-maintainers, yguenane
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in util-linux. The mount(8) SUID binary does not sanitize the LIBMOUNT_FORCE_MOUNT2 environment variable before use. A local unprivileged user can set this variable to force mount(8) to use the legacy two-step mount(2) code path, which applies security restrictions such as nosuid and noexec after the mount is already active. During this window, an attacker can execute a SUID binary from the mounted filesystem, allowing local privilege escalation to root.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-19 14:36:46 UTC

The SUID binary /usr/bin/mount from util-linux reads the LIBMOUNT_FORCE_MOUNT2 environment variable via an unsafe getenv() call rather than safe_getenv(), even when running with elevated privileges. An unprivileged local user can set LIBMOUNT_FORCE_MOUNT2=always to force mount(8) onto the legacy mount(2) code path, which performs a bind mount followed by a separate remount/propagation syscall to apply security flags such as nosuid and noexec. During the window between these two syscalls, the mounted filesystem is missing those protections, allowing the attacker to execute a SUID/SGID binary from the newly mounted filesystem before the restrictions are applied, resulting in local privilege escalation to root. Affects util-linux v2.39.1 through v2.43-devel (current master); unfixed as of the June 16, 2026 advisory. Reported upstream by Xinyao Hu. GHSA-67r7-8m5w-22wx.