Debugging of libmount can be activated, also in SUID binaries, thus spilling out the heap addresses. This allows to create a local domain socket with only 4k buffer size, fill it up until writes are blocking and then start umount with that socket as stdout. This allows race-free reading of the address output before umount accesses other user-controlled resource. Thus any error during the downstream procedure creating some kind of write-where vulnerability will always find the correct target.

References:
https://www.spinics.net/lists/util-linux-ng/msg14978.html