{"schemaVersion":3,"id":"SUSE-SU-2026:23861-1","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Security update for util-linux\n\nThis update for util-linux fixes the following issues:\n\n- CVE-2026-13595: heap use-after-free in `libblkid` nested partition probing (bsc#1269583).\n- CVE-2026-27456: TOCTOU in the mount program when setting up loop devices (bsc#1261606).\n- CVE-2026-53612: local privilege escalation via TOCTOU in mount(8) hook_owner.c chmod/chown (bsc#1268886).\n- CVE-2026-53613: local privilege escalation via TOCTOU in mount(8) - Target Path Redirection (bsc#1268886).\n- CVE-2026-53614: local privilege escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec\n  Bypass in SUID mount(8) (bsc#1268886).\n- CVE-2026-76642: failed external mount helper triggers privileged `X-mount` post-hooks, which enables local privilege\n  escalation (bsc#1278349).\n- CVE-2026-78408: `nsenter --join-cgroup` leaks root `cgroup` migration authority, which allows for migration or\n  termination of root processes (bsc#1278348).\n- CVE-2026-78410: restricted `bind` mounts do not pin the source, which allows for `X-mount.owner`/`group`/`mode`\n  redirection (bsc#1278347).\n\nChanges for util-linux:\n\n- lib/fileutils: add ul_openat_resolve() openat2 wrapper (bsc#1275441)\n- lib/fileutils: fix RESOLVE_NO_SYMLINKS fallback value\n- lib/fileutils: fix unused parameter warnings without SYS_openat2\n- libmount: add missing fileutils.h include to hook_idmap.c\n- libmount: add mnt_open_tree() helper for safe tree opening\n- libmount: pin source path with openat2() for restricted users\n (bsc#1275441, bsc#1278347, CVE-2026-78410)\n- libmount: restrict source path canonicalization for non-root\n users (bsc#1275441, bsc#1278347, CVE-2026-78410)\n- libmount: skip post-mount hooks after failed mount helper\n (bsc#1275441, bsc#1278349, CVE-2026-76642)\n- libmount: use USE_LIBMOUNT_MOUNTFD_SUPPORT for idmap hook\n- nsenter: close cgroup.procs fd after join to prevent authority\n leak (bsc#1275441, bsc#1278348, CVE-2026-78408)\n- nsenter, unshare: add O_CLOEXEC to all open() calls (bsc#1275441,\n bsc#1278348, CVE-2026-78408)\n- wall, write: sanitize hostname in banner header (bsc#1275441)\n- Add missing function. (bsc#1275441)\n- ipcutils: Prevent using uninitialized variable (bsc#1268886)\n- BREAKING CHANGE:\n Paths must always be canonicalized for unprivileged users to\n ensure safe target resolution. X-mount.nocanonicalize is ignored\n for them.\n- INCOMAPTIBLE CHANGE (linux < 6.15):\n X-mount.subdir: The safe detached subdirectory is no more\n supported for unprivileged users for safety reasons.\n- liblastlog2: Wait on busy SQLite connections (bsc#1268886).\n- libmount: Fix subvolid buffer overflow in get_btrfs_fs_root\n (bsc#1268886).\n- libblkid: Fix use-after-free in nested partition probing\n (bsc#1269583, bsc#1268886, CVE-2026-13595)\n- libmount: fix SUID bypass via LIBMOUNT_FORCE_MOUNT2 and legacy\n mount path (bsc#1268886, CVE-2026-53614, GHSA-67r7-8m5w-22wx).\n- fileutils: add ul_open_no_symlinks() needed by other patches\n (bsc#1268886).\n- libmount: add fd_target to context for TOCTOU race condition\n prevention (bsc#1268886, CVE-2026-53613, GHSA-8gj5-72r3-428g).\n- libmount: ignore X-mount.nocanonicalize for restricted users\n- libmount: use fd-based fchownat/chmod in hook_owner (bsc#1268886,\n CVE-2026-53612, GHSA-g8wm-75wr-g2vh).\n- libmount: restrict X-mount.subdir for non-root (bsc#1268886).\n- libmount: use fd_target in hook_idmap for move_mount()\n- libmount: add mount ID verification and man page TOCTOU note\n- loopdev: use openat2(RESOLVE_NO_SYMLINKS) for backing file\n (bsc#1268886#c2, bsc#1261606).\n- Ignore pam-config error that prevents update failure if common*\n pam configuration is not symlink to common-*-pc (bsc#1270219).","dates":{"published":"2026-09-22T07:23:33.000Z","modified":"2026-09-27T18:23:16.546Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":null,"severity":"unknown","version":null,"versionLabel":null,"source":null,"vector":null,"computed":false,"selection":"none"},"metrics":[]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"suse","product":"python-libmount&distro=SUSE Linux Enterprise Server 16.0","name":"python-libmount","label":"python-libmount&distro=SUSE Linux Enterprise Server 16.0","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/python-libmount&distro=SUSE Linux Enterprise Server 16.0","purlType":"rpm","versions":[{"text":"< 2.41.1-160000.5.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.41.1-160000.5.1","eol":null,"hubHref":null},{"vendor":"suse","product":"python-libmount&distro=SUSE Linux Enterprise Server for SAP applications 16.0","name":"python-libmount","label":"python-libmount&distro=SUSE Linux Enterprise Server for SAP applications 16.0","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/python-libmount&distro=SUSE Linux Enterprise Server for SAP applications 16.0","purlType":"rpm","versions":[{"text":"< 2.41.1-160000.5.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.41.1-160000.5.1","eol":null,"hubHref":null},{"vendor":"suse","product":"util-linux-systemd&distro=SUSE Linux Enterprise Server 16.0","name":"util-linux-systemd","label":"util-linux-systemd&distro=SUSE Linux Enterprise Server 16.0","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/util-linux-systemd&distro=SUSE Linux Enterprise Server 16.0","purlType":"rpm","versions":[{"text":"< 2.41.1-160000.5.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.41.1-160000.5.1","eol":null,"hubHref":null},{"vendor":"suse","product":"util-linux-systemd&distro=SUSE Linux Enterprise Server for SAP applications 16.0","name":"util-linux-systemd","label":"util-linux-systemd&distro=SUSE Linux Enterprise Server for SAP applications 16.0","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/util-linux-systemd&distro=SUSE Linux Enterprise Server for SAP applications 16.0","purlType":"rpm","versions":[{"text":"< 2.41.1-160000.5.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.41.1-160000.5.1","eol":null,"hubHref":null},{"vendor":"suse","product":"util-linux&distro=SUSE Linux Enterprise Server 16.0","name":"util-linux","label":"util-linux&distro=SUSE Linux Enterprise Server 16.0","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/util-linux&distro=SUSE Linux Enterprise Server 16.0","purlType":"rpm","versions":[{"text":"< 2.41.1-160000.5.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.41.1-160000.5.1","eol":null,"hubHref":null},{"vendor":"suse","product":"util-linux&distro=SUSE Linux Enterprise Server for SAP applications 16.0","name":"util-linux","label":"util-linux&distro=SUSE Linux Enterprise Server for SAP applications 16.0","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/util-linux&distro=SUSE Linux Enterprise Server for SAP applications 16.0","purlType":"rpm","versions":[{"text":"< 2.41.1-160000.5.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.41.1-160000.5.1","eol":null,"hubHref":null}],"affectedCount":6,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623861-1/","label":"www.suse.com/support/update/announcement/2026/suse-su-202623861-1/","hostname":"www.suse.com","tags":["Advisory"]},{"url":"https://bugzilla.suse.com/1261606","label":"bugzilla.suse.com/1261606","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1268886","label":"bugzilla.suse.com/1268886","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1269583","label":"bugzilla.suse.com/1269583","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1270219","label":"bugzilla.suse.com/1270219","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1275441","label":"bugzilla.suse.com/1275441","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1278347","label":"bugzilla.suse.com/1278347","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1278348","label":"bugzilla.suse.com/1278348","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1278349","label":"bugzilla.suse.com/1278349","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://www.suse.com/security/cve/CVE-2026-13595","label":"www.suse.com/security/cve/CVE-2026-13595","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27456","label":"www.suse.com/security/cve/CVE-2026-27456","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53612","label":"www.suse.com/security/cve/CVE-2026-53612","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53613","label":"www.suse.com/security/cve/CVE-2026-53613","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53614","label":"www.suse.com/security/cve/CVE-2026-53614","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-76642","label":"www.suse.com/security/cve/CVE-2026-76642","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78408","label":"www.suse.com/security/cve/CVE-2026-78408","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78410","label":"www.suse.com/security/cve/CVE-2026-78410","hostname":"www.suse.com","tags":["WEB"]}],"lineage":{"upstream":["CVE-2026-13595","CVE-2026-27456","CVE-2026-53612","CVE-2026-53613","CVE-2026-53614","CVE-2026-76642","CVE-2026-78408","CVE-2026-78410"],"downstream":[],"duplicates":[],"related":["CVE-2026-13595","CVE-2026-27456","CVE-2026-53612","CVE-2026-53613","CVE-2026-53614","CVE-2026-76642","CVE-2026-78408","CVE-2026-78410"]},"timeline":[{"kind":"published","date":"2026-09-22T07:23:33.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-09-27T18:23:16.546Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":0,"level":"minimal","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-22T00:47:43.904Z","stale":false,"partial":false}}