ZeroDay Findings
Sign inSign up

Findings

CVE-2026-53614

util-linux is a random collection of Linux utilities.

Published Oct 14, 2026 · updated Oct 14, 2026

util-linux is a random collection of Linux utilities. In util-linux 2.39.1 through 2.41.4 and 2.42 through 2.42.1, the SUID utility reads the attacker-controlled environment variable with , allowing a local low-privileged user to force the non-atomic legacy bind-mount path. With an bind mount authorized by or and protected by , , or , an attacker can race the window between the initial bind mount and the remount that applies those security flags and execute a SUID program from the temporarily unprotected mount, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 14, 2026 · NIST NVD

    Detected

    util-linux is a random collection of Linux utilities. In util-linux 2.39.1 through 2.41.4 and 2.42 through 2.42.1, the SUID utility reads the attacker-controlled environment variable with , allowing a local low-privileged user to force the non-atomic legacy bind-mount path. With an bind mount authorized by or and protected by , , or , an attacker can race the window between the initial bind mount

  2. Oct 14, 2026 · OSV.dev

    Fix available

    util-linux fixed in 2.41.5-0+deb13u1; util-linux fixed in 2.42.2-1

  3. Oct 14, 2026 · OSV.dev

    Fix available

    util-linux fixed in 2.41.5-0+deb13u1

  4. Oct 14, 2026 · OSV.dev

    Fix available

    util-linux fixed in 2.42.2-1

  5. Oct 14, 2026 · OSV.dev

    Updated

    util-linux is a random collection of Linux utilities. In util-linux 2.39.1 through 2.41.4 and 2.42 through 2.42.1, the SUID utility reads the attacker-controlled environment variable with , allowing a local low-privileged user to force the non-atomic legacy bind-mount path. With an bind mount authorized by or and protected by , , or , an attacker can race the window between the initial bind mount

Affected

  • Debian:13 util-linux0 → 2.41.5-0+deb13u1
  • Debian:14 util-linux0 → 2.42.2-1

Sources

  • CVE.orgCVE-2026-53614

    Official CVE identifier

    cve.org
  • NIST NVDCVE-2026-53614

    util-linux is a random collection of Linux utilities. In util-linux 2.39.1 through 2.41.4 and 2.42 through 2.42.1, the SUID utility reads the attacker-controlled environment variable with , allowing a local low-privileged user to force th

    nvd.nist.gov
  • OSV.devDEBIAN-CVE-2026-53614
    osv.dev

References

CVE-2026-53614 · ZeroDay Findings