CVE-2026-76642: util-linux
Vulnerability summary
CVE-2026-76642 is a high (CVSS 8.5) vulnerability in util-linux. EPSS estimates a 0.22% chance of exploitation in the next 30 days, higher than 11.2% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 6 · Related 5Timeline
- 03-09-2026PublishedVulnerability first disclosed.
- 03-09-2026Last modifiedVulnerability information updated.
Description
util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.
CVSS metrics
8 scores · 5 sources · 2 versions- OSV · AlpineEcosystem advisory · calculated8.5HighCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · UbuntuEcosystem advisory · calculated8.5HighCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- OSV · DebianEcosystem advisory · calculated8.5HighCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- NVDNIST8.5HighCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · UbuntuEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- NVDNIST7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.22%
Chance of exploitation in the next 30 days
Percentile
11%
Versus all other CVEs
30-day change
+0.04 pp
From 0.18% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Alpine1 product
- util-linux< 2.41.6-r0 | < 2.42.3-r0
Debian1 product
- util-linuxAll versions (No fix recorded) | < 2.42.3-1
Ubuntu1 product
- util-linuxAll versions (No fix recorded)
Util-linux1 product
- util-linux≥ 2.39, < 2.41.6 | ≥ 2.42, < 2.42.3
4 vendors · 4 products
References
13 links- github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.cTechnical Description
- github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.cTechnical Description
