CVE-2026-53612

A flaw was found in util-linux. When an /etc/fstab entry uses the user option together with X-mount.owner, X-mount.group, or X-mount.mode, mount(8) changes ownership or permissions on the mount target after mounting without re-verifying the path. A local unprivileged user can exploit this Time-of-Check-Time-of-Use (TOCTOU) window by swapping the target directory, redirecting the ownership/permission change to an arbitrary file and potentially escalating privileges to root.

This vulnerability is rated as having Important impact because an authenticated local user could achieve root privilege escalation by taking advantage of elevated setuid permissions during filesystem mounting. However, default installations of Red Hat Enterprise Linux do not define filesystem table entries combining unprivileged mounting rights with custom post-mount ownership or mode specifications. Earlier platform releases, including Red Hat Enterprise Linux 8 and 9, are unaffected as they do not contain the vulnerable hook logic. The flaw only poses a practical threat in specific environments where administrators explicitly configure user-accessible mounts with custom target attribute overrides within writable directory hierarchies.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

In SUID/restricted mode, reject X-mount.mode= values containing SUID/SGID bits (04000/02000). Verify mount target path ancestor chain integrity before post-hook execution.