CVE-2026-27456

A flaw was found in util-linux. When an /etc/fstab entry is configured with the user,loop options, the mount program checks the file path with user permissions but later opens it with root privileges. This creates a brief Time-of-Check-Time-of-Use (TOCTOU) window where an attacker can substitute the intended file with a malicious symbolic link. This allows a local unprivileged user to mount any root-owned file or block device that contains a valid filesystem, gaining full read access to its contents.

This vulnerability is only exploitable when an /etc/fstab entry exists with user,loop options and its source path points to a directory where the attacker has write permission (e.g., the user's home directory). Also, this issue allows an attacker to mount any root-owned file or block device containing a valid filesystem, causing information disclosure. There is no memory corruption or arbitrary code execution. Due to these reasons, this flaw has been rated with a moderate severity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this flaw, remove the 'user' option from any loop mounts in the /etc/fstab file or ensure the the source path points to a root-owned directory where unprivileged users do not have write permissions.