CVE-2026-27456

What it is

util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.

At a glance

Exploitability

Can be exploited locally on the machine with a low-privilege account. High risk of data exposure.

Exploit odds

0.2% chance of exploitation in the next 30 days (EPSS).

Fix

A patch, advisory or fixed version is referenced. Upgrade or apply it.

Timeline

1. 2026-04-03 22:16 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-07-24 22:10 UTC Last updatedMost recent change to the record

Why it ranks here

• Exploited in the wild: no, CISA does not list it.
• Exploit odds: 0.2% in the next 30 days (EPSS).
• Severity: 4.7 MEDIUM (CVSS).
• Fix: a patch or advisory is linked.

Details

Published

2026-04-03 22:16 UTC

Last modified

2026-07-24 22:10 UTC

Exploit probability

0.2% · EPSS, next 30 days

Weakness

CWE-59

Record status

Analyzed

Affected

• Kernel util-linux < 2.41.4

Attack profile CVSS 3.1 · 4.7

Attack vector

Local

Complexity

High

Privileges needed

Low

User interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Is it in your code?

Hand this to your coding agent. It searches your project for the affected products and checks versions. Nothing leaves your machine.

Read https://cve-list.com/agent/cve/CVE-2026-27456.md and follow it. Check whether this project is affected by CVE-2026-27456. Read only. Don't change anything and don't upload my code. Tell me yes, no or not sure, with the file as proof.

Copy as ticket · More options · Status badge