Vulnerability · CVE-2026-53613

util-linux is a random collection of Linux utilities.

Published Oct 14, 2026 · catalog updated Oct 15, 2026 · util-linux is a random

Check if you run it

No confirmed exploitation is on record for CVE-2026-53613. EPSS is 0.13%. Act only if a listed version of util-linux is a random is installed.

Gaps on this record

The stored product name is a package slug. The name on this page is taken from the title (util-linux is a random).
No vendor fix or required action is stored. Compare the linked advisory before you change production.

Severity: High7.0
Known exploitation: Not in CISA/VulnCheck KEV
EPSS: 0.13%
Remediation: Advisory link
Affected products: Alpine:v3.22 util-linux · Alpine:v3.23 util-linux · Alpine:v3.24 util-linux · Debian:12 util-linux · Debian:13 util-linux · Debian:14 util-linux

util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy path is used without , restricted non-root requests validate an target before the mount operation re-resolves that pathname. A local low-privileged user authorized by an fstab or entry whose target has an attacker-writable ancestor can use to swap a path component and redirect an authorized mount to a root-owned location, such as mounting attacker-controlled content over , and thereby gain root privileges. Versions 2.41.5 and 2.42.2 pin targets for the new mount API, and 2.42.4 pins legacy targets through ; the documented legacy fallback without remains affected.

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

Alpine:v3.22 util-linux0 → 2.41.6-r0
Alpine:v3.23 util-linux0 → 2.41.6-r0
Alpine:v3.24 util-linux0 → 2.42.3-r0
Debian:12 util-linux2.38.1-5, 2.38.1-5+deb12u1, 2.38.1-5+deb12u2
Debian:13 util-linux0 → 2.41.5-0+deb13u1
Debian:14 util-linux0 → 2.42.2-1

How to fix CVE-2026-53613

Recommended remediation
A patch or advisory reference is linked. Open the original publisher for availability by product version.
Official advisories

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-53613. EPSS is 0.13%. Act only if a listed version of util-linux is a random is installed.

Which versions are affected?

Compare what you have installed with 0 → 2.41.6-r0, 0 → 2.42.3-r0, 2.38.1-5, 2.38.1-5+deb12u1, 2.38.1-5+deb12u2, 0 → 2.41.5-0+deb13u1, 0 → 2.42.2-1. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition. EPSS 0.13%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Technology hubs

Debian security

Code

The project this record applies to. Exploit listings stay in References.

Repository · github.com

Timeline

Detection, updates, and resolution for this record.

Oct 14, 2026 · NIST NVD
Detected
util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy path is used without , restricted non-root requests validate an target before the mount operation re-resolves that pathname. A local low-privileged user authorized by an fstab or entry whose target has an attacker-writable ancestor can use to swap a path co
Oct 14, 2026 · OpenSSF OSV / OSV Scanner
Fix available
util-linux fixed in 2.41.5-0+deb13u1; util-linux fixed in 2.42.2-1
Oct 14, 2026 · OpenSSF OSV / OSV Scanner
Fix available
util-linux fixed in 2.41.5-0+deb13u1
Oct 14, 2026 · OpenSSF OSV / OSV Scanner
Fix available
util-linux fixed in 2.42.2-1
Oct 14, 2026 · OpenSSF OSV / OSV Scanner
Updated
util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy path is used without , restricted non-root requests validate an target before the mount operation re-resolves that pathname. A local low-privileged user authorized by an fstab or entry whose target has an attacker-writable ancestor can use to swap a path co
Oct 15, 2026 · OpenSSF OSV / OSV Scanner
Fix available
util-linux fixed in 2.41.6-r0; util-linux fixed in 2.41.6-r0; util-linux fixed in 2.42.3-r0
Oct 15, 2026 · OpenSSF OSV / OSV Scanner
Fix available
util-linux fixed in 2.41.6-r0
Oct 15, 2026 · OpenSSF OSV / OSV Scanner
Fix available
util-linux fixed in 2.42.3-r0
Oct 15, 2026 · OpenSSF OSV / OSV Scanner
Updated
util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy path is used without , restricted non-root requests validate an target before the mount operation re-resolves that pathname. A local low-privileged user authorized by an fstab or entry whose target has an attacker-writable ancestor can use to swap a path co
Oct 15, 2026 · NIST NVD
Updated
util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy path is used without , restricted non-root requests validate an target before the mount operation re-resolves that pathname. A local low-privileged user authorized by an fstab or entry whose target has an attacker-writable ancestor can use to swap a path co

Sources

CVE.orgVulnerability recordCVE-2026-53613
Official CVE identifier
cve.org
FIRST EPSSExploitation probabilityCVE-2026-53613
30-day exploitation probability 0.1%
first.org
NIST NVDVulnerability recordCVE-2026-53613
util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy path is used without , restricted non-root requests validate an target before the mount operation
nvd.nist.gov
OpenSSF OSV / OSV ScannerPackage advisoryALPINE-CVE-2026-53613
osv.dev
OpenSSF OSV / OSV ScannerPackage advisoryDEBIAN-CVE-2026-53613
osv.dev
Trivy Vulnerability DBPackage advisoryALPINE-CVE-2026-53613
util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy path is used without , restricted non-root requests validate an target before the mount operation re-resolves that pathname. A local low-
osv.dev

References

Freshness

Last verified in this catalog Oct 18, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

Priority score

23/100

Evidence confidence: High

Several independent sources name this vulnerability.

Confirmed exploitation0/30
EPSS probability1/20
CVSS severity11/15
Public exploit0/10
Internet exposure6/10
Product prevalence5/5
Threat research0/5

Decision signals

Four separate signals — do not infer one from another.

High

CVSS severity
7.0 v3.1
Technical impact. Separate from exploitation likelihood.
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS probability
0.13% · p2.17%
Estimated probability of exploitation within 30 days (FIRST).
Known exploitation
No verified KEV listing
Evidence from CISA KEV or VulnCheck KEV only — not from EPSS alone.
Patch availability
Advisory link
A patch or advisory reference is linked. Open the original publisher for availability by product version.

Stacks

Alpine Alpine 3.22 Alpine 3.23 Alpine 3.24 Debian Linux

Weakness

CWE-367
Time-of-check Time-of-use (TOCTOU) Race Condition
MITRE definition

Watch

A free account watches 5 technologies and gets a weekly digest. Professional adds immediate alerts.