ALSA-2026:93461

The util-linux packages contain a large variety of low-level system utilities that are necessary for a Linux system to function. Among others, these include the fdisk configuration tool and the login program.

Security Fix(es):

• util-linux: TOCTOU in the mount program when setting up loop devices (CVE-2026-27456)
• util-linux: util-linux: heap use-after-free in libblkid nested partition probing (CVE-2026-13595)
• util-linux: TOCTOU in the mount program via ancestor directory swap on target path (CVE-2026-53613)
• util-linux: util-linux: TOCTOU in the mount program when applying post-mount ownership/mode changes (CVE-2026-53612)
• util-linux: util-linux: SUID mount(8) allows nosuid/noexec bypass via LIBMOUNT_FORCE_MOUNT2 (CVE-2026-53614)
• util-linux: util-linux: failed external mount helper still runs privileged X-mount post-hooks (CVE-2026-76642)
• util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority (CVE-2026-78408)
• util-linux: util-linux: restricted bind mounts do not pin the source, allowing X-mount.owner/group/mode redirection (CVE-2026-78410)
• util-linux: util-linux: Partition metadata compromise via integer overflow in DOS partition parser (CVE-2026-53615)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.