CVE-2026-53614

A flaw was found in util-linux. The mount(8) SUID binary does not sanitize the LIBMOUNT_FORCE_MOUNT2 environment variable before use. A local unprivileged user can set this variable to force mount(8) to use the legacy two-step mount(2) code path, which applies security restrictions such as nosuid and noexec after the mount is already active. During this window, an attacker can execute a SUID binary from the mounted filesystem, allowing local privilege escalation to root.

A flaw was found in the util-linux mount(8) utility, which is installed with the SUID bit set. This flaw is rated IMPORTANT for affected Red Hat products, including Red Hat Enterprise Linux 10 and Red Hat In-Vehicle OS 2, where the vulnerable code is present and a fix is being pursued. The SUID mount(8) binary reads the LIBMOUNT_FORCE_MOUNT2 environment variable via an unsafe getenv() call rather than a sanitizing equivalent, even when running with elevated privileges. A local unprivileged attacker can set LIBMOUNT_FORCE_MOUNT2=always to force mount(8) onto the legacy mount(2) code path, which performs a bind mount and then applies security flags such as nosuid and noexec in a separate, subsequent syscall. During the window between these two syscalls, the newly mounted filesystem lacks those protections, allowing the attacker to execute a SUID/SGID binary from it before the restrictions take effect, resulting in local privilege escalation to root. Red Hat Enterprise Linux 7, 8, and 9, Red Hat OpenShift Container Platform releases, and other evaluated Red Hat offerings are not affected because the vulnerable code is not present in the util-linux versions shipped in those products. The Red Hat severity (CVSS 7.0, IMPORTANT) is consistent with the upstream CVSS score.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

In the legacy bind path, use mount_setattr() to apply security flags atomically, eliminating the window between the two syscalls. Add SUID regression test: LIBMOUNT_FORCE_MOUNT2=always must not change API path selection for unprivileged callers.