Privilege escalation in Util-Linux

CVE-2026-53614

util-linux is a random collection of Linux utilities. In util-linux 2.39.1 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility reads the attacker-controlled `LIBMOUNT_FORCE_MOUNT2` environment variable with `getenv()`, allowing a local low-privileged user to force the non-atomic legacy bind-mount path. With an `/etc/fstab` bind mount authorized by `user` or `users` and protected by `nosuid`, `noexec`, or `nodev`, an attacker can race the window between the initial bind mount and the remount that applies those security flags and execute a SUID program from the temporarily unprotected mount, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2.

Vulnerability class: Privilege Escalation

Published .

CVSS v3 metric

CVSS v3 base score 7.0 (High). Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

  • Util-Linux — versions >= 2.39.1, < 2.41.5, >= 2.42, < 2.42.2

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2026-53614?
CVE-2026-53614 is a high-severity vulnerability in Util-Linux, classified under Improper Privilege Management. CVSS score: 7.0/10. Published 2026-10-14.
How severe is CVE-2026-53614?
High severity. CVSS v3 base score is 7.0 out of 10.