CVE-2026-53613

When an /etc/fstab entry is configured with the user or users option, mount(8) validates the target path before performing the mount syscall, creating a Time-of-Check-Time-of-Use (TOCTOU) window. A local unprivileged user with write access to an ancestor directory of the mount target can swap that directory - for example by using renameat2(RENAME_EXCHANGE) - to redirect the mount to an arbitrary root-owned location, potentially escalating privileges to root.

This issue is rated Important and affects Red Hat products that ship util-linux, including Red Hat Enterprise Linux and OpenShift Container Platform, with fixes being pursued for the affected streams. Successful exploitation requires an /etc/fstab entry with the user or users option whose mount target has an attacker-writable ancestor directory, which limits the attack to specific configurations and is reflected in the high attack-complexity score.

Red Hat UBI images ship the affected util-linux package with mount(8) installed SUID root, and fixes are currently in progress across all active RHEL streams. Once the respective RHSA ships for each stream, updated UBI images are typically rebuilt within hours to days for Important severity CVEs. In the meantime, no action is required for standard (unprivileged) UBI container deployments, as the default container security controls prevent exploitation of this vulnerability:

• No /etc/fstab exists in the default UBI images. Exploitation requires an fstab entry with the user or users mount option - without one, the attack has no entry point.
• The mount syscall is blocked by default. Container runtimes do not grant CAP_SYS_ADMIN to containers, and the default seccomp profile further restricts mount operations.

Exploitation would require a non-standard configuration that simultaneously adds a custom fstab with user mount entries, grants CAP_SYS_ADMIN or runs the container in privileged mode, and provides writable directories in the mount target path. This combination does not occur in typical container workloads.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Review /etc/fstab and remove the user or users mount option from any entry where unprivileged user mounting is not strictly required. This eliminates the prerequisite for exploitation. For entries that must retain user mount capability, ensure all ancestor directories in the mount target path are owned by root and not writable by unprivileged users (mode 0755 or stricter), preventing the renameat2(RENAME_EXCHANGE) directory swap needed to exploit the race. These changes take effect immediately with no reboot required.