Nixpkgs security tracker

Login with GitHub

Details of issue NIXPKGS-2026-2502

NIXPKGS-2026-2502
published 7 hours ago
util-linux libmount Privilege Escalation via Failed Mount Helper
Permalink CVE-2026-76642
8.5 HIGH
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Vulnerable System Impact Confidentiality (VC): High (H)
  • Vulnerable System Impact Integrity (VI): High (H)
  • Vulnerable System Impact Availability (VA): High (H)
  • Subsequent System Impact Confidentiality (SC): None (N)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Vulnerable System Impact Confidentiality (MVC): High (H)
  • Modified Vulnerable System Impact Integrity (MVI): High (H)
  • Modified Vulnerable System Impact Availability (MVA): High (H)
  • Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
updated 7 hours ago by @LeSuisse Activity log
  • Created suggestion 13 hours ago
  • @LeSuisse ignored
    28 packages
    • more
    • wall
    • eject
    • mount
    • logger
    • umount
    • hexdump
    • libuuid
    • utillinux
    • libsmartcols
    • unixtools.col
    • unixtools.fsck
    • unixtools.more
    • unixtools.wall
    • unixtools.eject
    • unixtools.fdisk
    • unixtools.mount
    • unixtools.write
    • unixtools.column
    • unixtools.getopt
    • unixtools.logger
    • unixtools.script
    • unixtools.umount
    • unixtools.hexdump
    • unixtools.whereis
    • util-linuxMinimal
    • uutils-util-linux
    • unixtools.util-linux
    10 hours ago
  • @LeSuisse accepted 10 hours ago
  • @LeSuisse published on GitHub 7 hours ago
util-linux libmount Privilege Escalation via Failed Mount Helper

util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.

Affected products

util-linux
  • <2.41.6
  • <2.42.3

Matching in nixpkgs

Ignored packages (28)

pkgs.libuuid

Set of system utilities for Linux

pkgs.utillinux

Set of system utilities for Linux

Package maintainers