MGASA-2026-0560

See a problem?
Please try reporting it to the source first.
Source
https://advisories.mageia.org/MGASA-2026-0560.html
Import Source
https://advisories.mageia.org/MGASA-2026-0560.json
JSON Data
https://api.osv.dev/v1/vulns/MGASA-2026-0560
Upstream
CVE (8)
Published
2026-10-27T20:02:56Z
Modified
2026-10-27T20:15:03Z
Summary
Updated util-linux package fixes security vulnerabilities
Details

Additional fix for CVE-2024-28085. Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown. (CVE-2026-53612) Local Privilege Escalation via TOCTOU in mount(8) — Target Path Redirection. (CVE-2026-53613) Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable — nosuid/noexec Bypass in SUID mount(8). (CVE-2026-53614) mount(8) post-mount hooks execute after helper failure. (CVE-2026-76642) nsenter(1), unshare(1) file descriptor leak. (CVE-2026-78408) mount(8) X-mount.subdir symlink escape. (CVE-2026-78409) mount(8) TOCTOU race on source path. (CVE-2026-78410)

References
Credits

Affected packages

Mageia:10 / util-linux

Package

Name
util-linux
Purl
pkg:rpm/mageia/util-linux?arch=source&distro=mageia-10

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.42.4-1.mga10

Ecosystem specific 

{
    "section":  "core"
}

Database specific

source 
"https://advisories.mageia.org/MGASA-2026-0560.json"