A flaw was found in BusyBox's mount utility. (CVE-2026-88838)

CVE-2026-88838 describes a security flaw in BusyBox's mount utility where non-root users can bypass mount restrictions set in /etc/fstab. The issue occurs because clearing-mask options specified on the command line pass the non-root flag filter and are merged with existing fstab options as strings. When these combined options are re-parsed, the clearing options can override critical security flags such as nosuid, nodev, and noexec, which are intended to restrict mount behavior and enhance system security.

This vulnerability allows a non-root user to bypass mount security restrictions, potentially enabling them to mount filesystems with elevated privileges or with security protections disabled. Although it does not grant root privileges directly, it can lead to increased risk of privilege escalation or unauthorized access to system resources by circumventing administrator-enforced mount options.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should restrict mount utility access to trusted users only and monitor for unusual mount activity. Avoid allowing non-root users to execute mount commands if possible.