Bug 2531352 (CVE-2026-88838)

Summary: CVE-2026-88838 busybox: busybox: non-root mount option filter bypass allows clearing fstab security restrictions
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: security-response-team
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in BusyBox's mount utility. A non-root user can bypass mount security restrictions set in /etc/fstab by specifying clearing-mask options on the command line. These options pass the non-root flag filter and are merged with fstab options as strings; when the combined options are re-parsed, clearing options can override nosuid, nodev, and noexec protections the administrator intended to enforce.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-09-10 09:48:23 UTC 
A vulnerability exists in the BusyBox mount applet's non-root option filter in util-linux/mount.c. The filter uses cmdopt_flags & ~MS_SILENT to test for dangerous options, but clearing-mask options (suid, dev, exec) AND bits off rather than OR bits on, evaluating to zero and passing the check unconditionally. This allows a non-root user to strip nosuid, nodev, and noexec restrictions from fstab-defined user mounts.

The finding was reproduced only after artificially setting the setuid bit on BusyBox. Only the filter bypass was demonstrated, not actual privilege escalation.