{"id":"CVE-2026-76642","summary":"util-linux libmount Privilege Escalation via Failed Mount Helper","details":"util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.","aliases":["GHSA-m25x-3hj9-m26f"],"modified":"2026-11-02T10:41:47.947954969Z","published":"2026-09-03T10:54:08.150Z","related":["ALSA-2026:93461","SUSE-SU-2026:23861-1","SUSE-SU-2026:23870-1","SUSE-SU-2026:23884-1","openSUSE-SU-2026:11870-1","openSUSE-SU-2026:21905-1"],"database_specific":{"cna_assigner":"VulnCheck","cwe_ids":["CWE-390"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/76xxx/CVE-2026-76642.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/76xxx/CVE-2026-76642.json"},{"type":"ADVISORY","url":"https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76642"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper"},{"type":"FIX","url":"https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a"},{"type":"FIX","url":"https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc"},{"type":"FIX","url":"https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf"},{"type":"PACKAGE","url":"https://github.com/util-linux/util-linux"},{"type":"ARTICLE","url":"https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476"},{"type":"ARTICLE","url":"https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/util-linux/util-linux","events":[{"introduced":"2dccaae42bfdd0f1e34da11f2023480655308e1b"},{"fixed":"02822c9374fc72d38baf8a1f859eb0813970bf3f"},{"introduced":"0a7dfc376192e8fb1e7bdb2d0c90d8b9b173a42b"},{"fixed":"6f20a5defcf9066d4d2af372424a1576bd3d495d"},{"fixed":"f57cea130839c0af8dc0525274267ae4cfd66bbf"},{"fixed":"1d14676ea70003e9f5b2a6a76af0cadb1190411a"},{"fixed":"a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"2.39"},{"fixed":"2.41.6"}],"source":"AFFECTED_FIELD","strategy":"StandardRange"},{"source":"AFFECTED_FIELD","strategy":"StandardRange","range":[{"introduced":"2.42"},{"fixed":"2.42.3"}]},{"source":"REFERENCES_COMMIT","range":[{"fixed":"f57cea130839c0af8dc0525274267ae4cfd66bbf"}]},{"range":[{"fixed":"1d14676ea70003e9f5b2a6a76af0cadb1190411a"}],"source":"REFERENCES_COMMIT"},{"source":"REFERENCES_COMMIT","range":[{"fixed":"a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc"}]}]}}],"versions":["v2.42.2","v2.41.5","v2.41.4","v2.42.1","v2.42","v2.42-rc2","v2.42-rc1","v2.43-devel","v2.41.3","v2.41.2","v2.41.2-rc1","v2.41.1","v2.41","v2.41-rc2","v2.41-rc1","v2.42-start"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-76642.json","vanir_signatures":[{"id":"CVE-2026-76642-02c5f09c","signature_type":"Function","signature_version":"v1","source":"https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc","target":{"file":"libmount/src/context_mount.c","function":"mnt_context_mount"},"deprecated":false,"digest":{"length":1541,"function_hash":"231834648963002285768291963693058281121"}},{"digest":{"length":1541,"function_hash":"231834648963002285768291963693058281121"},"id":"CVE-2026-76642-364af411","signature_type":"Function","signature_version":"v1","source":"https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a","target":{"file":"libmount/src/context_mount.c","function":"mnt_context_mount"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a","target":{"file":"libmount/src/hook_loopdev.c","function":"hookset_deinit"},"deprecated":false,"digest":{"function_hash":"133281925866185137591021574535477504190","length":253},"id":"CVE-2026-76642-46f46d62","signature_type":"Function"},{"id":"CVE-2026-76642-48118b48","signature_type":"Function","signature_version":"v1","source":"https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf","target":{"file":"libmount/src/context_mount.c","function":"mnt_context_mount"},"deprecated":false,"digest":{"function_hash":"242289989841050256691018651834816396743","length":1541}},{"deprecated":false,"digest":{"line_hashes":["55218515733450798731216135315735916816","3921252240536986979700149378665315172","277961465953627764036107494254536282790","116312463450562576640736865666202195992","286365227122950077258756110158610680107","4370948598745793075799969918370406079","321625399388288065797316329286763398233","103175749726201353795086785314674694522","277400334890740258290850723335185369218","263198089839489699495144096384057141722","244674509374242799767948705796383511211"],"threshold":0.9},"id":"CVE-2026-76642-49e3e2c7","signature_type":"Line","signature_version":"v1","source":"https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc","target":{"file":"libmount/src/context_mount.c"}},{"digest":{"threshold":0.9,"line_hashes":["55218515733450798731216135315735916816","3921252240536986979700149378665315172","277961465953627764036107494254536282790","116312463450562576640736865666202195992","286365227122950077258756110158610680107","4370948598745793075799969918370406079","321625399388288065797316329286763398233","103175749726201353795086785314674694522","277400334890740258290850723335185369218","263198089839489699495144096384057141722","244674509374242799767948705796383511211"]},"id":"CVE-2026-76642-63143645","signature_type":"Line","signature_version":"v1","source":"https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf","target":{"file":"libmount/src/context_mount.c"},"deprecated":false},{"source":"https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc","target":{"function":"mnt_context_do_mount","file":"libmount/src/context_mount.c"},"deprecated":false,"digest":{"function_hash":"55827025012798539621447988673971646146","length":1023},"id":"CVE-2026-76642-7a273734","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf","target":{"function":"hookset_deinit","file":"libmount/src/hook_loopdev.c"},"deprecated":false,"digest":{"length":253,"function_hash":"314485091134137154508197357793663630715"},"id":"CVE-2026-76642-833ddf50","signature_type":"Function"},{"id":"CVE-2026-76642-a9870b0c","signature_type":"Line","signature_version":"v1","source":"https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc","target":{"file":"libmount/src/hook_loopdev.c"},"deprecated":false,"digest":{"line_hashes":["17989711024947974121519068396662392088","311889267921061494022393327700764872631","78115924382164963739391726279642525773","100479621781559039280967416493069183298","117108681030351722332625637983199545564","57987610330545539796159969617597419598","194446008419049159158263308909908607334","168250881839990326691700181141875524368"],"threshold":0.9}},{"source":"https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf","target":{"file":"libmount/src/context_mount.c","function":"mnt_context_do_mount"},"deprecated":false,"digest":{"function_hash":"207800752218999914478399995797338025413","length":1023},"id":"CVE-2026-76642-a9c83566","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"55827025012798539621447988673971646146","length":1023},"id":"CVE-2026-76642-cedb1f78","signature_type":"Function","signature_version":"v1","source":"https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a","target":{"file":"libmount/src/context_mount.c","function":"mnt_context_do_mount"}},{"digest":{"length":253,"function_hash":"133281925866185137591021574535477504190"},"id":"CVE-2026-76642-dbb87783","signature_type":"Function","signature_version":"v1","source":"https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc","target":{"file":"libmount/src/hook_loopdev.c","function":"hookset_deinit"},"deprecated":false},{"source":"https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf","target":{"file":"libmount/src/hook_loopdev.c"},"deprecated":false,"digest":{"line_hashes":["17989711024947974121519068396662392088","311889267921061494022393327700764872631","78115924382164963739391726279642525773","198602760997071500301932192730649687640","87304573351533731340658457077414531463","270897980139346454566214339069973491182","194446008419049159158263308909908607334","168250881839990326691700181141875524368"],"threshold":0.9},"id":"CVE-2026-76642-e2941f61","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["55218515733450798731216135315735916816","3921252240536986979700149378665315172","277961465953627764036107494254536282790","116312463450562576640736865666202195992","286365227122950077258756110158610680107","4370948598745793075799969918370406079","321625399388288065797316329286763398233","103175749726201353795086785314674694522","277400334890740258290850723335185369218","263198089839489699495144096384057141722","244674509374242799767948705796383511211"]},"id":"CVE-2026-76642-e825cbc6","signature_type":"Line","signature_version":"v1","source":"https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a","target":{"file":"libmount/src/context_mount.c"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a","target":{"file":"libmount/src/hook_loopdev.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["17989711024947974121519068396662392088","311889267921061494022393327700764872631","78115924382164963739391726279642525773","100479621781559039280967416493069183298","117108681030351722332625637983199545564","57987610330545539796159969617597419598","194446008419049159158263308909908607334","168250881839990326691700181141875524368"]},"id":"CVE-2026-76642-ed250ad0"}],"vanir_signatures_modified":"2026-10-28T11:17:47Z"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}]}