CVE-2026-78410: Time-of-check Time-of-use (TOCTOU) Race Condition in Red Hat Red Hat Hardened Images

The vulnerability exists in util-linux versions 2.39 through 2.42.2, where restricted bind mounts do not pin the source path before performing a privileged mount operation. An unprivileged local user with the ability to replace the authorized source or a writable ancestor directory can exploit this TOCTOU race condition to redirect a SUID mount(8) to bind another host directory. If the fstab entry specifies X-mount.owner, X-mount.group, or X-mount.mode, root will then apply ownership or mode changes to the redirected inode, potentially allowing unauthorized access or modification of files. The flaw was introduced in util-linux v2.39 and fixed in versions 2.41.6 and 2.42.3. Red Hat has released security updates for Red Hat Hardened Images including util-linux 2.42.2-3.4.hum1 which addresses this issue.

This vulnerability allows a local unprivileged user to escalate privileges by redirecting privileged mount operations to unauthorized directories. The root user may unknowingly change ownership or permissions on files or directories that the attacker controls, leading to full confidentiality, integrity, and availability compromise of affected resources. The CVSS v3.1 score is 7.8 (high), reflecting the low attack complexity and low privileges required, with no user interaction needed. The impact includes unauthorized file access, modification, and potential disruption of system operations.

A fix is available and should be applied by upgrading util-linux to version 2.41.6, 2.42.3, or later. Red Hat has released updated RPM packages for Red Hat Hardened Images that include this fix. Until the update is applied, administrators should ensure that unprivileged /etc/fstab bind or rbind entries do not specify X-mount.owner, X-mount.group, or X-mount.mode, especially when the bind source is under a user-writable ancestor directory. This mitigates the risk of exploitation by preventing the redirection of privileged mounts.