{"id":"AZL-99390","summary":"CVE-2026-78410 affecting package util-linux 2.40.2-5","details":"A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.","modified":"2026-09-09T05:29:25Z","published":"2026-09-02T16:17:23Z","upstream":["CVE-2026-78410"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78410"}],"affected":[{"package":{"name":"util-linux","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/util-linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.40.2-5"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-99390.json"}}],"schema_version":"1.9.0"}