Detection of Error Condition Without Action in Util-linux - CVE-2026-76642

Vulnerability identifier: #VU146721

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-76642

CWE-ID: CWE-390

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to incorrect status handling in libmount post-mount hooks when processing a failed external mount helper. A local user can trigger a nonzero helper exit for a root-controlled fstab entry with X-mount.idmap to escalate privileges.

Exploitation requires SUID-root mount(8), a usable root-controlled fstab entry, a failed external mount helper, and an idmap-capable filesystem target.

Util-linux
Anolis OS
openEuler
Fedora
uuidd
util-linux-i18n
util-linux-core
util-linux
python3-libmount
libuuid-devel
libuuid
libsmartcols-devel
libsmartcols
libmount-devel
libmount
libfdisk-devel
libblkid
libblkid-devel
libfdisk
util-linux-help
util-linux-user
util-linux-devel
util-linux-debugsource
util-linux-debuginfo

Install security update from vendor's website.

Util-linux - addressed in versions 2.41.6, 2.42.3
uuidd - update to 2.39.1-13
util-linux-i18n - update to 2.39.1-13
util-linux-core - update to 2.39.1-13
util-linux - update to 2.39.1-13
python3-libmount - update to 2.39.1-13
libuuid-devel - update to 2.39.1-13
libuuid - update to 2.39.1-13
libsmartcols-devel - update to 2.39.1-13
libsmartcols - update to 2.39.1-13
libmount-devel - update to 2.39.1-13
libmount - update to 2.39.1-13
libfdisk-devel - update to 2.39.1-13
libblkid - update to 2.39.1-13
libblkid-devel - update to 2.39.1-13
libfdisk - update to 2.39.1-13
libblkid - update to 2.39.1-44
util-linux-help - update to 2.39.1-44
uuidd - update to 2.39.1-44
util-linux-user - update to 2.39.1-44
util-linux-devel - update to 2.39.1-44
util-linux-debugsource - update to 2.39.1-44
util-linux-debuginfo - update to 2.39.1-44
python3-libmount - update to 2.39.1-44
libuuid - update to 2.39.1-44
libsmartcols - update to 2.39.1-44
libmount - update to 2.39.1-44
libfdisk - update to 2.39.1-44
util-linux - update to 2.39.1-44
util-linux - addressed in versions 2.41.6-1.fc43, 2.41.6-1.fc44

• https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f
• https://github.com/util-linux/util-linux/commit/f94a7760ed7ce81389a6059f020238981627a70d

• Multiple vulnerabilities in Util-linux
• openEuler 24.03 LTS SP3 update for util-linux
• Anolis OS update for util-linux
• Fedora 44 update for util-linux
• Fedora 43 update for util-linux