CVE-2026-27456: 
NixOS vulnerability analysis and mitigation

CVE-2026-27456 is a TOCTOU (Time-of-Check-Time-of-Use) race condition vulnerability in the SUID binary /usr/bin/mount from util-linux that allows a local unprivileged user to gain unauthorized read access to root-owned files and block devices. Discovered by researcher Julio Ángel Ferrari Medina (aka T0X1Cx) and disclosed on April 3, 2026, it affects util-linux versions prior to 2.41.4. The vulnerability has a CVSS v3.1 base score of 4.7 (Medium) (GitHub Advisory, Microsoft MSRC).

The vulnerability is classified under CWE-367 (TOCTOU Race Condition), CWE-59 (Improper Link Resolution / Link Following), and CWE-269 (Improper Privilege Management). The mount binary performs a two-phase path resolution: in Phase 1, it validates the source file path with user privileges via fork() + setuid() + realpath() inside sanitize_paths(); in Phase 2, it re-canonicalizes and opens the file as root (euid=0) via loopcxt_set_backing_file() → ul_canonicalize_path() and loopcxt_setup_device() → open(), without using O_NOFOLLOW, inode comparison, or post-open fstat(). When /etc/fstab contains the explicit loop option, the intermediate stat() + S_ISREG() check in is_loopdev_required() is bypassed entirely. An attacker exploits the large race window (spanning hundreds of syscalls between validation and open) by using renameat2(RENAME_EXCHANGE) to atomically swap the legitimate filesystem image with a symlink pointing to any root-owned file, causing mount to open the target as root (GitHub Advisory, Patch Commit).

Successful exploitation grants a local unprivileged user full read access to any root-owned file or block device that contains a valid filesystem, including /etc/shadow, SSH private keys, .env files with credentials, backup images, and encrypted disk volumes. The mounted filesystem has MS_SECURE flags applied (nosuid, nodev, noexec), which prevents execution of SUID binaries but does not restrict data reading. There is no integrity or availability impact; the vulnerability is purely a confidentiality breach that could enable credential theft and lateral movement (GitHub Advisory).

A complete, compilable C proof-of-concept exploit (exploit_toctou_loop_v3.c) is publicly available in the GitHub Security Advisory, using multi-threaded renameat2(RENAME_EXCHANGE) to win the race — reportedly on the first attempt in testing. The EPSS score is 0.01% (very low probability of widespread exploitation), and there is no evidence of in-the-wild exploitation or CISA KEV catalog listing as of the time of this report. Exploitation requires specific preconditions: an /etc/fstab entry with user,loop options pointing to a directory writable by the attacker, the SUID bit set on /usr/bin/mount (default on virtually all Linux distributions), and Linux kernel ≥ 3.15 for renameat2(RENAME_EXCHANGE) (GitHub Advisory, Feedly).

1. Reconnaissance: Confirm the target system runs util-linux < 2.41.4 with /usr/bin/mount having the SUID bit set (ls -la /usr/bin/mount), and identify an /etc/fstab entry with user,loop options whose source path is in a directory writable by the attacker (e.g., the user's home directory).
2. Prepare the legitimate image: Ensure a valid ext4 filesystem image exists at the fstab source path (e.g., /home/kali/disk.img) — this is required for Phase 1 validation to succeed.
3. Prepare the symlink: Create a hidden symlink (e.g., /home/kali/.disk.img.lnk) pointing to the target root-owned file (e.g., /root/secret.img).
4. Compile the exploit: As the unprivileged user, compile the PoC: gcc -O2 -o exploit_v3 exploit_toctou_loop_v3.c -lpthread.
5. Launch race threads: Run ./exploit_v3 /home/kali/disk.img /mnt/toctou_test /root/secret.img. The exploit spawns 4 threads that continuously swap the source path between the real image and the symlink using renameat2(RENAME_EXCHANGE), ensuring sanitize_paths() sees the real image (passes user-privilege check) while loopcxt_setup_device() → open() sees the symlink (opens target as root).
6. Verify race win: After mount returns exit code 0, check /proc/self/mountinfo and /sys/block/loopN/loop/backing_file to confirm the target file is mounted instead of the legitimate image.
7. Read sensitive data: Access the mounted filesystem at the mount point to read root-protected files: cat /mnt/toctou_test/etc/shadow, cat /mnt/toctou_test/root/.ssh/id_rsa, cat /mnt/toctou_test/opt/app/.env.
8. Cleanup: Unmount the filesystem (umount /mnt/toctou_test) and restore the original image at the fstab path (GitHub Advisory).

• Process: Unusual child processes spawned by an unprivileged user invoking /usr/bin/mount with only a mount point argument (no source); multiple rapid, repeated mount/umount invocations from the same unprivileged user in a short time window.
• File System: Presence of a hidden symlink (e.g., .filename.lnk) in a user-writable directory that is referenced in /etc/fstab; a backup hardlink (e.g., .filename.bak) alongside the fstab source image; the fstab source path alternating rapidly between a regular file and a symlink.
• Logs: Kernel or audit log entries showing mount syscalls where the loop device's backing file (/sys/block/loopN/loop/backing_file) resolves to a root-owned file not matching the fstab source path; auditd records of renameat2 syscalls with RENAME_EXCHANGE flag from an unprivileged user in a directory referenced by fstab.
• Network: Unexpected outbound connections following a successful mount event, potentially indicating exfiltration of credentials (e.g., SSH keys or database passwords) read from the mounted filesystem (GitHub Advisory).

Upgrade util-linux to version 2.41.4 or later, which introduces the LOOPDEV_FL_NOFOLLOW flag that adds O_NOFOLLOW to the open() call and uses strdup() instead of ul_canonicalize_path() (which follows symlinks) for non-root restricted mount operations (Patch Commit, Release v2.41.4). As interim workarounds: remove the SUID bit from /usr/bin/mount (chmod u-s /usr/bin/mount), remove user,loop options from /etc/fstab entries pointing to user-writable directories, or restrict write access to directories referenced in such fstab entries. IBM Business Automation Insights users should apply the May 2026 iFixes (IBM Advisory). SUSE has also released security updates addressing this issue (SUSE Advisory).

The vulnerability was reported by researcher Julio Ángel Ferrari Medina (T0X1Cx) and acknowledged by util-linux maintainer Karel Zak, who committed the fix (Patch Commit). Multiple Linux distributions including Fedora, SUSE/openSUSE, and Solus issued security advisories and package updates. IBM and Splunk also published advisories for affected products. The German security news site Pro-Linux covered the vulnerability, and the Yocto Project security mailing list flagged it for embedded Linux maintainers.