A vulnerability exists in the BusyBox mount applet's non-root option filter in util-linux/mount.c. The filter uses cmdopt_flags & ~MS_SILENT to test for dangerous options, but clearing-mask options (suid, dev, exec) AND bits off rather than OR bits on, evaluating to zero and passing the check unconditionally. This allows a non-root user to strip nosuid, nodev, and noexec restrictions from fstab-defined user mounts.

The finding was reproduced only after artificially setting the setuid bit on BusyBox. Only the filter bypass was demonstrated, not actual privilege escalation.