TOCTOU Vulnerability in Mount Utility from Util-Linux

CVE-2026-27456

What is CVE-2026-27456?

A TOCTOU vulnerability exists in the SUID binary /usr/bin/mount of the Util-Linux package, affecting versions prior to 2.41.4. This vulnerability arises from inadequate checks during the mounting process of loop devices, where a local unprivileged user can exploit a race condition to substitute a source file with a symlink leading to root-owned files or devices. Specifically, the vulnerabilities arise from the lack of O_NOFOLLOW, inode comparison, and post-open fstat() checks. The exploitation requires an /etc/fstab entry configured for user,loop options. This condition can grant attackers unauthorized read access to critical system files and block devices, posing a serious security risk. To mitigate this vulnerability, users are advised to upgrade to version 2.41.4 or later.

References