A race condition vulnerability exists in util-linux's SUID mount binary /usr/bin/mount. The fstab validation and permission checks for the mount target occur before the actual mount syscall executes. A local unprivileged attacker can exploit this window using renameat2(RENAME_EXCHANGE) (or equivalent ancestor directory swaps) to redirect the intended target path to an arbitrary root-owned location, such as /etc/sudoers.d, causing SUID mount(8) to mount there instead. Exploitation requires an /etc/fstab entry with the user or users option where an ancestor directory of the mount target is writable by the attacker. Affects util-linux v2.17 through v2.43-devel (unfixed as of the June 16, 2026 advisory). Reported upstream by Xinyao Hu. GHSA-8gj5-72r3-428g.