util-linux security update (CVE-2026-53612)

The util-linux package contains several vulnerabilities related to the mount(8) SUID binary. CVE-2026-53612 currently lacks public details. CVE-2026-53613 describes a Time-of-Check-Time-of-Use (TOCTOU) race condition when mount(8) validates target paths configured with user or users options in /etc/fstab, allowing an attacker with write access to an ancestor directory to redirect mounts and escalate privileges. CVE-2026-53614 involves mount(8) not sanitizing the LIBMOUNT_FORCE_MOUNT2 environment variable, enabling an unprivileged user to force usage of a legacy mount code path that temporarily bypasses security restrictions, allowing execution of SUID binaries from mounted filesystems and privilege escalation. CVE-2026-78410 concerns restricted bind mounts where the source path is not pinned before mounting, allowing an attacker to redirect mounts to arbitrary host directories and cause root to change ownership or mode on those redirected inodes. Affected versions include util-linux v2.39.1 through v2.43-devel (current master).

These vulnerabilities allow local unprivileged users to escalate privileges to root by exploiting race conditions, environment variable misuse, and insecure mount source handling in the mount(8) utility. The impact includes full system compromise due to unauthorized root access.

A patch is available for these vulnerabilities. Users should apply the official updates to util-linux to remediate these issues. No additional mitigation steps are indicated beyond applying the fix.