CVE-2026-88838: BusyBox Mount Utility Auth Bypass Flaw

CVE-2026-88838 Overview

CVE-2026-88838 is a security feature bypass in the BusyBox mount utility. A non-root user can override mount restrictions declared in /etc/fstab by passing clearing-mask options on the command line. BusyBox permits these options past its non-root flag filter and merges them with fstab options as strings. When the combined option string is re-parsed, clearing flags cancel nosuid, nodev, and noexec protections that administrators configured. The weakness is tracked as [CWE-693: Protection Mechanism Failure].

Critical Impact

A local, unprivileged user can neutralize nosuid, nodev, and noexec safeguards on administrator-defined mounts, enabling execution of setuid binaries or device files from user-controlled filesystems.

Affected Products

• BusyBox mount applet (versions implementing fstab option merging without re-filtering)
• Linux distributions and embedded systems bundling the affected BusyBox utility
• Container images using BusyBox as the base userland

Discovery Timeline

• 2026-10-13 - CVE-2026-88838 published to the National Vulnerability Database (NVD)
• 2026-10-15 - Last updated in NVD database

Technical Details for CVE-2026-88838

Vulnerability Analysis

The BusyBox mount applet lets unprivileged users mount entries listed in /etc/fstab when the user option is present. To preserve administrator intent, BusyBox filters command-line options passed by non-root callers, blocking flags such as suid, dev, and exec. The filter inspects only additive flags and does not reject the corresponding clearing-mask variants that remove already-set bits.

When the applet constructs the final option set, it concatenates the user-supplied options with the fstab options as a single string. That string is parsed a second time by the mount code path, where clearing flags take effect and strip the hardening bits originally present in /etc/fstab. The result is a successful mount operation that silently drops nosuid, nodev, or noexec.

Exploitation is local and requires only an existing fstab entry that permits user mounts. Confidentiality is unaffected, but integrity impact is high because an attacker can execute setuid-root binaries from a controlled filesystem image or expose block and character devices intended to be suppressed.

Root Cause

The root cause is a two-stage option handling flow. The non-root filter validates individual tokens but does not account for options that negate flags. Merging user and fstab options into a single string before re-parsing allows the second parse pass to apply the clearing bits over the administrator's protective flags.

Attack Vector

An authenticated local user invokes busybox mount on an fstab entry that includes nosuid, nodev, or noexec, appending clearing-mask options on the command line. BusyBox accepts the options, merges them, and performs the mount with the hardening flags cleared. The attacker then executes a setuid binary or accesses a device node on the mounted filesystem to escalate privileges or break out of restricted environments.

See the Red Hat CVE-2026-88838 Advisory and Red Hat Bug Report #2531352 for additional technical context.

Detection Methods for CVE-2026-88838

Indicators of Compromise

• Mount operations invoked by non-root users against fstab entries that administrators configured with nosuid, nodev, or noexec.
• Entries in /proc/mounts whose active flags are weaker than the matching /etc/fstab definition.
• Execution of setuid-root binaries from paths originating under user-mountable filesystems.

Detection Strategies

• Audit execve and mount syscalls with Linux auditd to correlate unprivileged mount invocations with subsequent setuid or device access.
• Periodically compare the flags reported in /proc/self/mountinfo against the declarations in /etc/fstab and alert on drift.
• Flag any BusyBox mount command line containing clearing-mask tokens such as suid, dev, or exec issued by a non-root UID.

Monitoring Recommendations

• Forward auditd mount and execve events to a centralized logging platform for behavioral analysis.
• Baseline expected mount operations per host and alert on anomalies tied to interactive user sessions.
• Monitor container runtimes and embedded devices for BusyBox invocations that modify mount flags at runtime.

How to Mitigate CVE-2026-88838

Immediate Actions Required

• Apply the BusyBox update provided by your distribution once it is published; track status via the Red Hat CVE-2026-88838 Advisory.
• Remove the user and users options from /etc/fstab entries that must remain hardened until patches are deployed.
• Inventory container images and embedded firmware that ship BusyBox and prioritize rebuilds.

Patch Information

At publication time, consult the Red Hat CVE-2026-88838 Advisory and Red Hat Bug Report #2531352 for fix availability across supported BusyBox builds. Apply vendor-signed packages rather than rebuilding from source where possible.

Workarounds

• Replace user-mountable fstab entries with explicit sudo rules that invoke mount with a fixed option set.
• Restrict access to the BusyBox mount applet using filesystem permissions or Linux capabilities on multi-user systems.
• Mount sensitive directories read-only or from trusted sources only, and avoid granting mount privileges inside containers.

# Configuration example
# Harden fstab entries by removing the user option until patches are available
# Before:
# /dev/sdb1  /mnt/data  ext4  user,nosuid,nodev,noexec  0 0
# After:
/dev/sdb1  /mnt/data  ext4  nosuid,nodev,noexec  0 0

# Audit non-root mount invocations
auditctl -a always,exit -F arch=b64 -S mount -F auid>=1000 -F auid!=4294967295 -k busybox_mount