CVE-2026-78410 Overview
A time-of-check to time-of-use (TOCTOU) flaw exists in util-linux affecting restricted bind mounts. The SUID mount(8) binary reads the source path from /etc/fstab but does not pin that source before performing the privileged mount operation. A local unprivileged user who can replace an authorized source path or a writable ancestor directory can redirect the bind mount to an attacker-chosen host directory. When the fstab entry also specifies X-mount.owner, X-mount.group, or X-mount.mode, root then applies ownership or permission changes to the redirected inode, enabling privilege escalation on affected Linux systems.
Critical Impact
Local attackers can escalate privileges by redirecting root-executed ownership and permission changes to arbitrary filesystem locations.
Affected Products
- util-linux (upstream package)
- Red Hat Enterprise Linux distributions shipping affected util-linux versions
- Linux distributions using SUID mount(8) with restricted bind mount support
Discovery Timeline
- 2026-09-02 - CVE CVE-2026-78410 published to NVD
- 2026-09-02 - Last updated in NVD database
Technical Details for CVE-2026-78410
Vulnerability Analysis
The flaw is classified as a Time-of-Check Time-of-Use race condition [CWE-367]. Restricted bind mounts in util-linux permit unprivileged users to invoke SUID mount(8) against pre-authorized fstab entries. The mount helper resolves the source path from fstab, validates it, and then performs the bind mount as root. Between path resolution and the privileged mount() syscall, the source path is not pinned via an open file descriptor or equivalent handle.
An attacker who controls a writable ancestor directory of the authorized source can swap the source component during this window. The kernel then performs the bind mount against the substituted target. If the fstab entry contains X-mount.owner, X-mount.group, or X-mount.mode options, the mount helper subsequently applies chown() or chmod() operations as root against the redirected inode.
Root Cause
The root cause is missing path pinning between validation and use. The mount(8) helper trusts that the source path resolved from fstab remains stable across the privileged operation. It does not open the source with O_PATH or otherwise lock the resolved inode against replacement, allowing the atomicity of the check-then-use sequence to be broken by concurrent filesystem changes.
Attack Vector
Exploitation requires local access with an unprivileged shell on a system where an administrator has configured a restricted bind mount entry in /etc/fstab with metadata modification options. The attacker must have write access to the authorized source path or one of its ancestor directories. By racing the mount operation with a rename() or symlink swap, the attacker redirects the bind mount to a sensitive target such as /etc/shadow or a directory containing SUID binaries. The root-executed chown or chmod then hands ownership of that target to the attacker.
No verified public exploit code is available. Refer to the GitHub Security Advisory GHSA-rh77-686x-2f2m for upstream technical detail.
Detection Methods for CVE-2026-78410
Indicators of Compromise
- Unexpected ownership or permission changes on system files, particularly files matching paths adjacent to authorized fstab bind mount sources.
- mount(8) invocations by unprivileged users immediately followed by chown or chmod audit records against unrelated inodes.
- New SUID binaries appearing in user-writable directories after user-initiated mount events.
Detection Strategies
- Audit /etc/fstab for entries combining bind with X-mount.owner, X-mount.group, or X-mount.mode options and flag them for review.
- Enable auditd rules on the mount, chown, chmod, and rename syscalls to correlate mount activity with subsequent metadata changes.
- Monitor for rename() or symlink manipulation on ancestor directories of authorized bind mount sources during mount operations.
Monitoring Recommendations
- Centralize Linux audit logs and alert on sequences where a non-root UID invokes mount followed by a root-context fchownat or fchmodat on paths outside the declared bind mount source.
- Baseline permissions on sensitive system files including /etc/shadow, /etc/passwd, and /etc/sudoers and alert on drift.
- Track privileged filesystem metadata changes on hosts with SUID mount(8) enabled for interactive users.
How to Mitigate CVE-2026-78410
Immediate Actions Required
- Apply vendor updates for util-linux as soon as patched packages are available from your distribution.
- Review /etc/fstab and remove X-mount.owner, X-mount.group, and X-mount.mode options from any user-mountable bind entries until patched.
- Restrict which users can invoke mount(8) by auditing the user, users, and owner options in fstab.
Patch Information
Consult the Red Hat CVE-2026-78410 Advisory and the Red Hat Bug Report #2522684 for fixed package versions. Upstream fix guidance is tracked in the GitHub Security Advisory GHSA-rh77-686x-2f2m. Apply distribution updates through your standard package manager once vendor advisories publish fixed versions.
Workarounds
- Remove X-mount.* metadata options from all restricted bind mount entries in /etc/fstab to eliminate the privileged chown/chmod primitive.
- Ensure that the source paths of authorized bind mounts and all ancestor directories are owned by root and not writable by unprivileged users or groups.
- Consider removing the SUID bit from /bin/mount on multi-user systems where user-invoked mounts are not required.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
