CVE-2026-53613
util-linux is a random collection of Linux utilities.
Published Oct 14, 2026 · updated Oct 14, 2026
util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy path is used without , restricted non-root requests validate an target before the mount operation re-resolves that pathname. A local low-privileged user authorized by an fstab or entry whose target has an attacker-writable ancestor can use to swap a path component and redirect an authorized mount to a root-owned location, such as mounting attacker-controlled content over , and thereby gain root privileges. Versions 2.41.5 and 2.42.2 pin targets for the new mount API, and 2.42.4 pins legacy targets through ; the documented legacy fallback without remains affected.
Timeline
Detection, updates, and resolution for this record.
Oct 14, 2026 · NIST NVD
Detected
util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy path is used without , restricted non-root requests validate an target before the mount operation re-resolves that pathname. A local low-privileged user authorized by an fstab or entry whose target has an attacker-writable ancestor can use to swap a path co
Oct 14, 2026 · OSV.dev
Fix available
util-linux fixed in 2.41.5-0+deb13u1; util-linux fixed in 2.42.2-1
Oct 14, 2026 · OSV.dev
Fix available
util-linux fixed in 2.41.5-0+deb13u1
Oct 14, 2026 · OSV.dev
Fix available
util-linux fixed in 2.42.2-1
Oct 14, 2026 · OSV.dev
Updated
util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy path is used without , restricted non-root requests validate an target before the mount operation re-resolves that pathname. A local low-privileged user authorized by an fstab or entry whose target has an attacker-writable ancestor can use to swap a path co
Affected
- Debian:12 util-linux2.38.1-5, 2.38.1-5+deb12u1, 2.38.1-5+deb12u2
- Debian:13 util-linux0 → 2.41.5-0+deb13u1
- Debian:14 util-linux0 → 2.42.2-1
Sources
- CVE.orgCVE-2026-53613
Official CVE identifier
cve.org - NIST NVDCVE-2026-53613
util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy path is used without , restricted non-root requests validate an target before the mount operation
nvd.nist.gov - OSV.devDEBIAN-CVE-2026-53613osv.dev