Bug 2522684 (CVE-2026-78410)

Summary:	CVE-2026-78410 util-linux: util-linux: restricted bind mounts do not pin the source, allowing X-mount.owner/group/mode redirection
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	akhatavk, aos-team-art-private, asdas, crizzo, dpaolell, gtanzill, jbuscemi, jdelft, jupierce, kshier, lgarciaa, mbiarnes, ppalepu, ppostler, prdhamdh, rhel-process-autobot, security-response-team, sghai, sidsharm, stcannon, suppawar, teagle, vlaad, watson-tool-maintainers, yguenane
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-24 18:48:56 UTC

Restricted-user bind/rbind mounts authorize the source from /etc/fstab but do not pin that source inode before the privileged mount. libmount later opens the source as a pathname via open_tree(AT_FDCWD, source, OPEN_TREE_CLONE|...) (mnt_context_open_tree in context.c / hook_mount.c). A local unprivileged user who can replace the fstab bind source or a writable ancestor with a symlink can redirect SUID mount(8) to bind an attacker-selected host directory. When the same fstab entry includes X-mount.owner=, X-mount.group=, or X-mount.mode=, hook_owner.c then applies root-privileged fchownat()/chmod() to the mounted root, which for a bind mount is the redirected source inode. This is a source-side pathname TOCTOU; current HEAD already pins the target and uses fd-based owner hooks (the CVE-2026-53612 target-path fix), but that fd now refers to the attacker-redirected bind source. Distinct from the public loop backing-file TOCTOU and from CVE-2026-76642 (failed external helper still running post-hooks). X-mount.owner/group/mode was introduced with v2.39; no upstream fix as of 2026-08-24. Reported upstream by Alex0Young. GHSA-rh77-686x-2f2m.