The SUID binary /usr/bin/mount from util-linux reads the LIBMOUNT_FORCE_MOUNT2 environment variable via an unsafe getenv() call rather than safe_getenv(), even when running with elevated privileges. An unprivileged local user can set LIBMOUNT_FORCE_MOUNT2=always to force mount(8) onto the legacy mount(2) code path, which performs a bind mount followed by a separate remount/propagation syscall to apply security flags such as nosuid and noexec. During the window between these two syscalls, the mounted filesystem is missing those protections, allowing the attacker to execute a SUID/SGID binary from the newly mounted filesystem before the restrictions are applied, resulting in local privilege escalation to root. Affects util-linux v2.39.1 through v2.43-devel (current master); unfixed as of the June 16, 2026 advisory. Reported upstream by Xinyao Hu. GHSA-67r7-8m5w-22wx.