ZeroDay Findings
Sign inSign up

Findings

CVE-2026-53612

util-linux is a random collection of Linux utilities.

Published Jun 17, 2026 · updated Oct 15, 2026

util-linux is a random collection of Linux utilities. In util-linux 2.39 through 2.41.4 and 2.42 through 2.42.1, the SUID utility's post-mount hook performs path-based and operations on a previously validated mount target. A local low-privileged user authorized by an entry with or and an , , or option can use to race a writable ancestor of the target and redirect the privileged ownership or mode change to a root-owned path, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Aug 14, 2026 · OSV.dev

    Fix available

    util-linux fixed in 2.41.5-0+deb13u1; util-linux fixed in 2.42.2-1

  2. Oct 14, 2026 · NIST NVD

    Detected

    util-linux is a random collection of Linux utilities. In util-linux 2.39 through 2.41.4 and 2.42 through 2.42.1, the SUID utility's post-mount hook performs path-based and operations on a previously validated mount target. A local low-privileged user authorized by an entry with or and an , , or option can use to race a writable ancestor of the target and redirect the privileged ownership or mode c

  3. Oct 14, 2026 · OSV.dev

    Fix available

    util-linux fixed in 2.41.5-0+deb13u1

  4. Oct 14, 2026 · OSV.dev

    Fix available

    util-linux fixed in 2.42.2-1

  5. Oct 14, 2026 · NIST NVD

    Updated

    util-linux is a random collection of Linux utilities. In util-linux 2.39 through 2.41.4 and 2.42 through 2.42.1, the SUID utility's post-mount hook performs path-based and operations on a previously validated mount target. A local low-privileged user authorized by an entry with or and an , , or option can use to race a writable ancestor of the target and redirect the privileged ownership or mode c

  6. Oct 14, 2026 · OSV.dev

    Updated

    util-linux is a random collection of Linux utilities. In util-linux 2.39 through 2.41.4 and 2.42 through 2.42.1, the SUID utility's post-mount hook performs path-based and operations on a previously validated mount target. A local low-privileged user authorized by an entry with or and an , , or option can use to race a writable ancestor of the target and redirect the privileged ownership or mode c

  7. Oct 15, 2026 · OSV.dev

    Fix available

    util-linux fixed in 2.41.6-r0; util-linux fixed in 2.41.6-r0; util-linux fixed in 2.42.3-r0

  8. Oct 15, 2026 · OSV.dev

    Fix available

    util-linux fixed in 2.41.6-r0

  9. Oct 15, 2026 · OSV.dev

    Fix available

    util-linux fixed in 2.42.3-r0

  10. Oct 15, 2026 · OSV.dev

    Updated

    util-linux is a random collection of Linux utilities. In util-linux 2.39 through 2.41.4 and 2.42 through 2.42.1, the SUID utility's post-mount hook performs path-based and operations on a previously validated mount target. A local low-privileged user authorized by an entry with or and an , , or option can use to race a writable ancestor of the target and redirect the privileged ownership or mode c

Affected

  • Alpine:v3.22 util-linux0 → 2.41.6-r0
  • Alpine:v3.23 util-linux0 → 2.41.6-r0
  • Alpine:v3.24 util-linux0 → 2.42.3-r0
  • Debian:13 util-linux0 → 2.41.5-0+deb13u1
  • Debian:14 util-linux0 → 2.42.2-1

Sources

  • CVE.orgVulnerability recordCVE-2026-53612

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-53612

    30-day exploitation probability 0.1%

    first.org
  • NIST NVDVulnerability recordCVE-2026-53612

    util-linux is a random collection of Linux utilities. In util-linux 2.39 through 2.41.4 and 2.42 through 2.42.1, the SUID utility's post-mount hook performs path-based and operations on a previously validated mount target. A local low-p

    nvd.nist.gov
  • OSV.devPackage advisoryALPINE-CVE-2026-53612
    osv.dev
  • OSV.devPackage advisoryDEBIAN-CVE-2026-53612
    osv.dev

References