RLSA-2026:93461

    Dashboard / Vulnerabilities / RLSA-2026:93461

    RLSA-2026:93461

    Published: 3 Nov 2026Last Modified: 3 Nov 2026

    Summary: Important: util-linux security update

    Details: The util-linux packages contain a large variety of low-level system utilities that are necessary for a Linux system to function. Among others, these include the fdisk configuration tool and the login program. Security Fix(es): * util-linux: TOCTOU in the mount program when setting up loop devices (CVE-2026-27456) * util-linux: util-linux: heap use-after-free in libblkid nested partition probing (CVE-2026-13595) * util-linux: TOCTOU in the mount program via ancestor directory swap on target path (CVE-2026-53613) * util-linux: util-linux: TOCTOU in the mount program when applying post-mount ownership/mode changes (CVE-2026-53612) * util-linux: util-linux: SUID mount(8) allows nosuid/noexec bypass via LIBMOUNT_FORCE_MOUNT2 (CVE-2026-53614) * util-linux: util-linux: failed external mount helper still runs privileged X-mount post-hooks (CVE-2026-76642) * util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority (CVE-2026-78408) * util-linux: util-linux: restricted bind mounts do not pin the source, allowing X-mount.owner/group/mode redirection (CVE-2026-78410) * util-linux: util-linux: Partition metadata compromise via integer overflow in DOS partition parser (CVE-2026-53615) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

    References: https://errata.rockylinux.org/RLSA-2026:93461, https://bugzilla.redhat.com/show_bug.cgi?id=2454956, https://bugzilla.redhat.com/show_bug.cgi?id=2494101, https://bugzilla.redhat.com/show_bug.cgi?id=2519646, https://bugzilla.redhat.com/show_bug.cgi?id=2519647, https://bugzilla.redhat.com/show_bug.cgi?id=2519648, https://bugzilla.redhat.com/show_bug.cgi?id=2521999, https://bugzilla.redhat.com/show_bug.cgi?id=2522497, https://bugzilla.redhat.com/show_bug.cgi?id=2522684, https://bugzilla.redhat.com/show_bug.cgi?id=2552551, https://access.redhat.com/errata/RHSA-2026:93461

    Affected packages

    Package

    Name: util-linux

    Purl: pkg:rpm/rocky-linux/util-linux?distro=rocky-linux-10&epoch=0

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -0:2.40.2-18.el10_2.20

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    RLSA-2026:93461 | CVE-DB