CVE-2026-78410 Util-linux: util-linux: restricted bind mounts do not pin the source, allowing x-mount.owner/group/mode redirection
Local attackers can exploit a race condition in restricted bind mounts to redirect SUID mount operations, potentially modifying file ownership or permissions.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-78410?
CVE-2026-78410 is a high-severity vulnerability in Red Hat Enterprise Linux 10, published on 2 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.
Weakness: CWE-367
Which versions are affected by CVE-2026-78410?
How do I fix CVE-2026-78410?
Apply the vendor's patch.
Is CVE-2026-78410 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-78410 exists.
Sources
Also known as ALPINE-CVE-2026-78410, AZL-99390, BELL-CVE-2026-78410, CVE-2026-104886, DEBIAN-CVE-2026-78410, ECHO-5339-ad7c-f545 and 3 more.