CVE-2026-27456

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-27456
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-27456.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-27456
Aliases
  • GHSA-qq4x-vfq4-9h9g
Downstream
Related
Published
2026-04-03T21:23:00.984Z
Modified
2026-07-27T09:24:11.107945Z
Severity
  • 4.7 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
util-linux: TOCTOU Race Condition in util-linux mount(8) - Loop Device Setup
Details

util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27456.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-269",
        "CWE-367",
        "CWE-59"
    ]
}
References

Affected packages

Git / github.com/util-linux/util-linux

Affected ranges

Type
GIT
Repo
https://github.com/util-linux/util-linux
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
e147e16fa9a9d3b3ad5968bf42280966ac3a8529
Fixed
5e390467b26a3cf3fecc04e1a0d482dff3162fc4
Database specific 
{
    "cpe": "cpe:2.3:a:kernel:util-linux:*:*:*:*:*:*:*:*",
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.41.4"
        }
    ]
}

Affected versions

v2.*
v2.10f
v2.10m
v2.10s
v2.11b
v2.11f
v2.11m
v2.11n
v2.11o
v2.11q
v2.11r
v2.11t
v2.11u
v2.11v
v2.11w
v2.11x
v2.11y
v2.12
v2.12a
v2.12b
v2.12d
v2.12h
v2.12i
v2.12j
v2.12k
v2.12l
v2.12m
v2.12o
v2.12p
v2.12pre
v2.12q
v2.12q-pre1
v2.12q-pre2
v2.12r
v2.12r-pre1
v2.13
v2.13-pre1
v2.13-pre2
v2.13-pre3
v2.13-pre4
v2.13-pre5
v2.13-pre6
v2.13-pre7
v2.13-rc1
v2.13-rc2
v2.13-rc3
v2.14
v2.14-rc1
v2.14-rc2
v2.14-rc3
v2.15
v2.15-rc1
v2.15-rc2
v2.16
v2.16-rc1
v2.16-rc2
v2.17
v2.17-rc1
v2.17-rc2
v2.17-rc3
v2.18
v2.18-rc1
v2.18-rc2
v2.19
v2.19-rc1
v2.19-rc2
v2.19-rc3
v2.2
v2.20
v2.20-rc1
v2.20-rc2
v2.21
v2.21-rc1
v2.21-rc2
v2.22
v2.22-rc1
v2.22-rc2
v2.23
v2.23-rc1
v2.23-rc2
v2.24
v2.24-rc1
v2.24-rc2
v2.25
v2.25-rc1
v2.25-rc2
v2.26
v2.26-rc1
v2.26-rc2
v2.27
v2.27-rc1
v2.27-rc2
v2.28
v2.28-rc1
v2.28-rc2
v2.29
v2.29-rc1
v2.29-rc2
v2.30
v2.30-rc1
v2.30-rc2
v2.31
v2.31-rc1
v2.31-rc2
v2.32
v2.32-rc1
v2.32-rc2
v2.33
v2.33-rc1
v2.33-rc2
v2.34
v2.34-rc1
v2.34-rc2
v2.35
v2.35-rc1
v2.35-rc2
v2.36
v2.36-rc1
v2.36-rc2
v2.37
v2.37-rc1
v2.37-rc2
v2.38
v2.38-rc1
v2.38-rc2
v2.38-rc3
v2.38-rc4
v2.39
v2.39-rc1
v2.39-rc2
v2.39-rc3
v2.40-rc1
v2.41
v2.41-devel
v2.41-rc1
v2.41-rc2
v2.41-start
v2.41.1
v2.41.2
v2.41.2-rc1
v2.41.3
v2.42-start
v2.43-devel
v2.5
v2.7.1
v2.8
v2.9i
v2.9v

Database specific

vanir_signatures_modified 
"2026-07-27T09:24:11Z"
vanir_signatures 
[
    {
        "id": "CVE-2026-27456-0aacee98",
        "signature_version": "v1",
        "digest": {
            "function_hash": "181824420828116349628969132987390238291",
            "length": 2643.0
        },
        "signature_type": "Function",
        "target": {
            "function": "loopcxt_setup_device",
            "file": "lib/loopdev.c"
        },
        "source": "https://github.com/util-linux/util-linux/commit/5e390467b26a3cf3fecc04e1a0d482dff3162fc4",
        "deprecated": false
    },
    {
        "id": "CVE-2026-27456-2f8b088c",
        "signature_version": "v1",
        "digest": {
            "function_hash": "275582541338556880950891935069961735188",
            "length": 353.0
        },
        "signature_type": "Function",
        "target": {
            "function": "loopcxt_set_backing_file",
            "file": "lib/loopdev.c"
        },
        "source": "https://github.com/util-linux/util-linux/commit/5e390467b26a3cf3fecc04e1a0d482dff3162fc4",
        "deprecated": false
    },
    {
        "id": "CVE-2026-27456-71536bc0",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "30654884298135965453829100619382842676",
                "284877634596794671269644176326736707514",
                "60185837360609185145715190812760167390",
                "331664447028603842614077221479130865804"
            ]
        },
        "signature_type": "Line",
        "target": {
            "file": "include/loopdev.h"
        },
        "source": "https://github.com/util-linux/util-linux/commit/5e390467b26a3cf3fecc04e1a0d482dff3162fc4",
        "deprecated": false
    },
    {
        "id": "CVE-2026-27456-bf35d4ef",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "191299049309288260872233437536970783449",
                "213936454775363984182550115121855535090",
                "58115886371639823765726219619555508099",
                "148787741903638565984479733029197769495"
            ]
        },
        "signature_type": "Line",
        "target": {
            "file": "libmount/src/hook_loopdev.c"
        },
        "source": "https://github.com/util-linux/util-linux/commit/5e390467b26a3cf3fecc04e1a0d482dff3162fc4",
        "deprecated": false
    },
    {
        "id": "CVE-2026-27456-e20e5684",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "301147071237761744420783012050259039310",
                "259480792782040843222983174721685570600",
                "331258797035909311274918485733983960068",
                "331344308027496955379774053184636727347",
                "304340342550483111131512781487744997413",
                "207359331938843751581664831970219974471",
                "326504577873282085312209133573997021021",
                "249834514991481020223303974422184793283"
            ]
        },
        "signature_type": "Line",
        "target": {
            "file": "lib/loopdev.c"
        },
        "source": "https://github.com/util-linux/util-linux/commit/5e390467b26a3cf3fecc04e1a0d482dff3162fc4",
        "deprecated": false
    },
    {
        "id": "CVE-2026-27456-f4497197",
        "signature_version": "v1",
        "digest": {
            "function_hash": "278246948182860954011619579310704151007",
            "length": 4786.0
        },
        "signature_type": "Function",
        "target": {
            "function": "setup_loopdev",
            "file": "libmount/src/hook_loopdev.c"
        },
        "source": "https://github.com/util-linux/util-linux/commit/5e390467b26a3cf3fecc04e1a0d482dff3162fc4",
        "deprecated": false
    }
]
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-27456.json"