{"id":"CVE-2026-53613","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-53613","generatedAt":"2026-10-27T23:08:26.081Z","title":"A local low-privileged user authorized by an fstab `user` or `users` entry whose target has an attacker-writable ancestor can use `renameat2(RENAME_EXCHANGE)` to swap a path component and redirect an authorized mount to a root-owned location, such as…","description":"util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy `mount(2)` path is used without `/proc`, restricted non-root `mount` requests validate an `/etc/fstab` target before the mount operation re-resolves that pathname. A local low-privileged user authorized by an fstab `user` or `users` entry whose target has an attacker-writable ancestor can use `renameat2(RENAME_EXCHANGE)` to swap a path component and redirect an authorized mount to a root-owned location, such as mounting attacker-controlled content over `/etc/sudoers.d`, and thereby gain root privileges. Versions 2.41.5 and 2.42.2 pin targets for the new mount API, and 2.42.4 pins legacy targets through `/proc/self/fd`; the documented legacy fallback without `/proc` remains affected.","published":"2026-10-14T15:17:20.000Z","lastModified":"2026-10-16T16:00:34.000Z","status":"Awaiting Analysis","sourceIdentifier":"security-advisories@github.com","cvss":{"version":"3.1","score":7,"severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"},"cwe":["CWE-367"],"affected":[],"epss":{"score":0.00163,"percentile":0.05464,"date":"2026-10-26","history":[{"date":"2026-10-15","score":0.00128,"percentile":0.02166}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (0.16%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[{"kind":"new","label":"New CVE","at":"2026-10-14T15:17:20.000Z","detail":{"score":"7.0","severity":"HIGH","publishedAt":"2026-10-14T15:17:20.410Z"},"summary":"New CVE, high severity (CVSS 7.0)."}],"references":[{"url":"https://github.com/util-linux/util-linux/commit/0b010025a0e429bc80355c94db86a843395d49e2","source":"security-advisories@github.com"},{"url":"https://github.com/util-linux/util-linux/commit/0d3d55975aa3492c62fd345eac38f41cd166c0b0","source":"security-advisories@github.com"},{"url":"https://github.com/util-linux/util-linux/commit/2c773f336134acf016e639abb6f12ba7341fe4b8","source":"security-advisories@github.com"},{"url":"https://github.com/util-linux/util-linux/commit/39fef62bf3226abb6bb018fa8750afa0327e84b4","source":"security-advisories@github.com"},{"url":"https://github.com/util-linux/util-linux/commit/472cc3fb2d4d47cca7aab2e0b59eb3fb8a9359ec","source":"security-advisories@github.com"},{"url":"https://github.com/util-linux/util-linux/commit/646fb66603d10a7ac337e14f566f1af48e3107c9","source":"security-advisories@github.com"},{"url":"https://github.com/util-linux/util-linux/commit/708d1b3c51932dc5ba8082c7368187715e6a8d78","source":"security-advisories@github.com"},{"url":"https://github.com/util-linux/util-linux/commit/78a860982e036f38fe9c0b3344998df5ac2c2ff5","source":"security-advisories@github.com"},{"url":"https://github.com/util-linux/util-linux/commit/85d16b341f7232c9dbb4884b632e1e956584bee9","source":"security-advisories@github.com"},{"url":"https://github.com/util-linux/util-linux/commit/a9508d216eb8977979102782672e0470cc9bf2a2","source":"security-advisories@github.com"},{"url":"https://github.com/util-linux/util-linux/releases/tag/v2.41.5","source":"security-advisories@github.com"},{"url":"https://github.com/util-linux/util-linux/releases/tag/v2.42.2","source":"security-advisories@github.com"},{"url":"https://github.com/util-linux/util-linux/releases/tag/v2.42.4","source":"security-advisories@github.com"},{"url":"https://github.com/util-linux/util-linux/security/advisories/GHSA-8gj5-72r3-428g","source":"security-advisories@github.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-53613","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}