Issued at: 2026-11-03
Updated at: 2026-11-03
Advisory content derived from Red Hat RHSA-2026:93461, © Red Hat, Inc., used under CC BY 4.0, with modifications.
Synopsis
Important: util-linux security update
Description
The util-linux packages contain a large variety of low-level system utilities that are necessary for a Linux system to function. Among others, these include the fdisk configuration tool and the login program.
Security Fix(es):
* util-linux: TOCTOU in the mount program when setting up loop devices (CVE-2026-27456)
* util-linux: util-linux: heap use-after-free in libblkid nested partition probing (CVE-2026-13595)
* util-linux: TOCTOU in the mount program via ancestor directory swap on target path (CVE-2026-53613)
* util-linux: util-linux: TOCTOU in the mount program when applying post-mount ownership/mode changes (CVE-2026-53612)
* util-linux: util-linux: SUID mount(8) allows nosuid/noexec bypass via LIBMOUNT_FORCE_MOUNT2 (CVE-2026-53614)
* util-linux: util-linux: failed external mount helper still runs privileged X-mount post-hooks (CVE-2026-76642)
* util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority (CVE-2026-78408)
* util-linux: util-linux: restricted bind mounts do not pin the source, allowing X-mount.owner/group/mode redirection (CVE-2026-78410)
* util-linux: util-linux: Partition metadata compromise via integer overflow in DOS partition parser (CVE-2026-53615)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.