SB2026090246 - Multiple vulnerabilities in Util-linux

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026090246

SB2026090246 - Multiple vulnerabilities in Util-linux

Published: September 2, 2026

Security Bulletin ID SB2026090246
CSH Severity
High
Patch available
YES
Number of vulnerabilities 5
Exploitation vector Local access
Highest impact Data manipulation

Breakdown by Severity

High 20% Low 80%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 5 vulnerabilities.


1) Improper Neutralization of Special Elements in Output Used by a Downstream Component (CVE-ID: N/A)

CWE-ID: CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local user to inject terminal escape sequences into other users\' terminals.

The vulnerability exists due to improper neutralization of special elements in output used by a downstream component in wall(1)/write(1) message headers when interpolating a hostname controlled from a UTS namespace. A local user can set a crafted hostname and invoke wall(1) or write(1) to inject terminal escape sequences into other users\' terminals.

Exploitation requires the ability to change the hostname in the attacker\'s own UTS namespace, and delivery depends on the target terminal accepting messages; write(1) additionally requires the target user to have messages enabled.


2) Privilege Context Switching Error (CVE-ID: CVE-2026-78408)

CWE-ID: CWE-270 - Privilege Context Switching Error

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to migrate host root processes into attacker-controlled cgroups and cause a denial of service.

The vulnerability exists due to improper access control in sys-utils/nsenter.c when handling the --join-cgroup operation and executing a program after namespace and credential transitions. A local user can cause a privileged operator to invoke nsenter against an attacker-controlled target to inherit a root-opened cgroup.procs file descriptor and use it to migrate unrelated host root processes into an attacker-controlled cgroup and cause a denial of service.

User interaction is required, and exploitation depends on cgroup v2 with unprivileged user namespaces enabled.


3) Detection of Error Condition Without Action (CVE-ID: CVE-2026-76642)

CWE-ID: CWE-390 - Detection of error condition without action

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to incorrect status handling in libmount post-mount hooks when processing a failed external mount helper. A local user can trigger a nonzero helper exit for a root-controlled fstab entry with X-mount.idmap to escalate privileges.

Exploitation requires SUID-root mount(8), a usable root-controlled fstab entry, a failed external mount helper, and an idmap-capable filesystem target.


4) Link following (CVE-ID: CVE-2026-78409)

CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to expose host paths at an fstab-authorized mountpoint.

The vulnerability exists due to improper link resolution before file access in libmount X-mount.subdir detached-tree resolution when processing restricted-user X-mount.subdir paths with open_tree(). A local user can supply a crafted subdirectory path containing intermediate symlinks or procfs paths to expose host paths at an fstab-authorized mountpoint.

Exploitation requires a SUID-root mount(8) configuration that permits unprivileged users to perform fstab-authorized mounts with X-mount.subdir on Linux systems using the restricted-user detached-tree path.


5) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-78410)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to a time-of-check time-of-use race condition in restricted bind and rbind mount source handling in mount(8) when processing fstab-authorized bind mounts with X-mount.owner, X-mount.group, or X-mount.mode options. A local user can replace the authorized source path or a writable ancestor with a symlink to an attacker-selected directory to escalate privileges.

The issue affects SUID-root mount(8) restricted-user configurations where the authorized bind source is under a user-writable ancestor and the same fstab entry enables ownership or mode-changing post-mount hooks.


Remediation

Install update from vendor's website.

References