A race condition exists in util-linux's SUID mount binary (hook_owner.c). When the X-mount.owner, X-mount.group, or X-mount.mode fstab options are set, mount(8) performs a post-mount permission change (lchown()/chmod()) on the mount target path without re-verifying the path still refers to the object that was just mounted. A local unprivileged attacker can use an atomic ancestor directory swap in the window between the mount and the ownership/mode change to redirect the chown/chmod operation to an arbitrary file, gaining control of that file and potentially escalating privileges to root. Exploitation requires an /etc/fstab entry with the user option plus one of X-mount.owner/group/mode, and an ancestor directory writable by the attacker. Introduced in commit 722c96974dd4 (2022-04-19); affects util-linux v2.39 through v2.41.3 (unfixed as of the June 16, 2026 advisory). Reported upstream by Xinyao Hu. GHSA-g8wm-75wr-g2vh.