Summary
CVE-2026-53614 is a local privilege-escalation vulnerability in the SUID util-linux mount utility. A low-privileged user may influence mount behavior through an environment variable and race the application of security flags, potentially executing a SUID program from a temporarily unprotected bind mount to gain root privileges.
CVE-2026-53614 is a local privilege-escalation vulnerability in the SUID util-linux mount utility. A low-privileged user may influence mount behavior through an environment variable and race the application of security flags, potentially executing a SUID program from a temporarily unprotected bind mount to gain root privileges.
Affected context
The vulnerability affects deployments using the SUID mount utility with /etc/fstab bind-mount entries that permit user-controlled mounting through the user or users options. Risk is increased when those mounts rely on nosuid, noexec, or nodev, because the legacy non-atomic mount-and-remount sequence can briefly expose the mount before the protective flags are applied.
The vulnerability affects deployments using the SUID mount utility with /etc/fstab bind-mount entries that permit user-controlled mounting through the user or users options. Risk is increased when those mounts rely on nosuid, noexec, or nodev, because the legacy non-atomic mount-and-remount sequence can briefly expose the mount before the protective flags are applied.
Exploit preconditions
- Attack surface: Local execution through the SUID
mountutility - Required access: A low-privileged local account permitted to use an applicable
/etc/fstabbind mount - Trigger point: Processing of a user-authorized bind mount while
LIBMOUNT_FORCE_MOUNT2influences mount-path selection - Required configuration: The bind mount is protected by security flags such as
nosuid,noexec, ornodev - Why exploitation is possible: The forced legacy path creates a race window between the initial bind mount and the remount that applies the protective flags
- Attack surface: Local execution through the SUID
mountutility - Required access: A low-privileged local account permitted to use an applicable
/etc/fstabbind mount - Trigger point: Processing of a user-authorized bind mount while
LIBMOUNT_FORCE_MOUNT2influences mount-path selection - Required configuration: The bind mount is protected by security flags such as
nosuid,noexec, ornodev - Why exploitation is possible: The forced legacy path creates a race window between the initial bind mount and the remount that applies the protective flags
Why this happens
The underlying issue combines reliance on attacker-controlled environment data with an unsafe privileged operation sequence. The SUID mount utility reads LIBMOUNT_FORCE_MOUNT2 using getenv() and can consequently select a non-atomic legacy bind-mount path. Security properties expected from the final remount are not present during the intermediate state, allowing a local user to race the transition and use the mount before its restrictions are enforced. This relates to CWE-269: Improper Privilege Management and CWE-807: Reliance on Untrusted Inputs in a Security Decision.
The underlying issue combines reliance on attacker-controlled environment data with an unsafe privileged operation sequence. The SUID mount utility reads LIBMOUNT_FORCE_MOUNT2 using getenv() and can consequently select a non-atomic legacy bind-mount path. Security properties expected from the final remount are not present during the intermediate state, allowing a local user to race the transition and use the mount before its restrictions are enforced. This relates to CWE-269: Improper Privilege Management and CWE-807: Reliance on Untrusted Inputs in a Security Decision.
Potential impact
- A local attacker may execute a SUID program from a temporarily unrestricted mount.
- The attacker could gain root-level privileges.
- Security controls such as
nosuid,noexec, ornodevmay be bypassed during the race window. - The host may be exposed to further compromise, persistence, or lateral movement.
- A local attacker may execute a SUID program from a temporarily unrestricted mount.
- The attacker could gain root-level privileges.
- Security controls such as
nosuid,noexec, ornodevmay be bypassed during the race window. - The host may be exposed to further compromise, persistence, or lateral movement.
General mitigation guidance
Mitigation generally focuses on preventing untrusted environment data from influencing privileged mount behavior and ensuring security attributes are applied atomically or before access is possible.
Common defensive patterns include:
- Ignoring or sanitizing attacker-controlled environment variables in SUID programs.
- Using mount operations that apply security flags as part of one indivisible transaction where supported.
- Avoiding legacy mount-and-remount sequences for security-sensitive bind mounts.
- Restricting
userandusersauthorization in/etc/fstabto mounts that do not expose sensitive content. - Applying least privilege to the
mountutility and limiting SUID binaries and executable content on user-writable filesystems. - Treating mount options as security boundaries and validating their effective state before allowing access.
Mitigation generally focuses on preventing untrusted environment data from influencing privileged mount behavior and ensuring security attributes are applied atomically or before access is possible.
Common defensive patterns include:
- Ignoring or sanitizing attacker-controlled environment variables in SUID programs.
- Using mount operations that apply security flags as part of one indivisible transaction where supported.
- Avoiding legacy mount-and-remount sequences for security-sensitive bind mounts.
- Restricting
userandusersauthorization in/etc/fstabto mounts that do not expose sensitive content. - Applying least privilege to the
mountutility and limiting SUID binaries and executable content on user-writable filesystems. - Treating mount options as security boundaries and validating their effective state before allowing access.
How teams detect issues like this
Detection can combine host configuration review, code analysis, and runtime monitoring:
- Inspect
/etc/fstabfor user-authorized bind mounts combined withnosuid,noexec, ornodev. - Review privileged code for direct use of environment variables in mount-operation decisions.
- Use static analysis rules to flag
getenv()or equivalent environment access in SUID code without an explicit trust boundary. - Check for non-atomic mount followed by remount sequences in privileged utilities.
- Monitor mount events, unexpected bind mounts, and execution of binaries from newly mounted paths.
- Enforce policy checks that reject user-authorized mounts lacking appropriate restrictions.
Automated security review tools may help identify unsafe environment handling and privileged filesystem-operation patterns.
Detection can combine host configuration review, code analysis, and runtime monitoring:
- Inspect
/etc/fstabfor user-authorized bind mounts combined withnosuid,noexec, ornodev. - Review privileged code for direct use of environment variables in mount-operation decisions.
- Use static analysis rules to flag
getenv()or equivalent environment access in SUID code without an explicit trust boundary. - Check for non-atomic mount followed by remount sequences in privileged utilities.
- Monitor mount events, unexpected bind mounts, and execution of binaries from newly mounted paths.
- Enforce policy checks that reject user-authorized mounts lacking appropriate restrictions.
Automated security review tools may help identify unsafe environment handling and privileged filesystem-operation patterns.
