CVE-2026-76642

Katalog CVE

CVSS 7.8 · High EPSS 0,22%

Kerentanan Detection of Error Condition Without Action. Skor CVSS 3.1 7.8 (High) menurut vulncheck.com.

Deskripsi (NVD)

util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.

Rincian

Terbit di NVD

3 September 2026

Terakhir diubah

24 September 2026

Status NVD

Awaiting Analysis

CVSS 3.1

7.8 (High), sumber vulncheck.com
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-390: Detection of Error Condition Without Action

EPSS (30 hari)

0,22% peluang dieksploitasi; lebih tinggi dari 11,1% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/util-linux/util-linux
• https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476
• https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892
• https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a
• https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc
• https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf
• https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f
• https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper