CVE-2026-76642: 
CBL Mariner vulnerability analysis and mitigation

CVE-2026-76642 is a local privilege escalation vulnerability in util-linux's libmount library, where a failed external mount helper still triggers privileged post-mount hooks. Affected versions are util-linux 2.39 through 2.41.5 and 2.42 through 2.42.2; fixed versions are 2.41.6 and 2.42.3. The vulnerability was published on September 2, 2026, with patches released shortly after. It carries a CVSS v3.1 base score of 7.8 (High) and a CVSS v4.0 base score of 8.5 (High) (Red Hat Advisory, GitHub Advisory).

The root cause (CWE-390: Detection of Error Condition Without Action) lies in libmount/src/context_mount.c: the exec_helper() function stores a nonzero helper exit code in cxt->helper_status but returns zero (indicating fork/exec/wait infrastructure success), which propagates as a successful mount result. Consequently, mnt_context_do_mount() unconditionally invokes MNT_STAGE_MOUNT_POST and MNT_STAGE_POST hooks even when the helper failed. Two privileged hooks are exploitable: hook_idmap.c clones and idmaps the pre-existing target filesystem (inheriting suid/exec from the root mount, bypassing fstab's nosuid,nodev,noexec), and hook_owner.c performs fchownat()/chmod() on the physical target inode without verifying helper success. Exploitation requires a SUID-root mount(8), a root-controlled fstab entry with user permission and X-mount.idmap or X-mount.owner options, and an external filesystem helper that exits nonzero — any normal validation or transient error is sufficient (GitHub Advisory, Patch Commit).

A local unprivileged user (UID 1000) can achieve EUID 0 (full root) deterministically without any race condition, symlink substitution, or malicious helper. Via the X-mount.idmap path, the attacker gains raw read/write access to root-owned filesystem content through an idmapped clone, and can place a SUID ELF binary executable through the mapped view and execute it via a pre-opened raw directory file descriptor to obtain a root shell. Via the X-mount.owner path, the attacker can transfer ownership and permissions of any root-owned directory to themselves even without a successful mount. Both attack paths are confirmed on Debian Trixie (2.41-5) and Debian sid (2.42.2-2), and the exploit is fully deterministic (GitHub Advisory).

A proof-of-concept reproducer (including setup scripts, a C source for a root-shell demo binary, and check scripts) was published alongside the advisory by the reporter (GitHub Advisory). The NVD SSVC assessment classifies exploitation as 'poc' with 'total' technical impact. The EPSS score is approximately 0.165% (low automated exploitation probability), and there is no evidence of in-the-wild exploitation or CISA KEV catalog listing as of the report date. The vulnerability is not remotely exploitable — it requires local access with specific fstab prerequisites (Red Hat Advisory).

1. Reconnaissance: Confirm the target system runs a vulnerable util-linux version (2.39–2.41.5 or 2.42–2.42.2) with a SUID-root mount(8) binary (ls -la /usr/bin/mount).
2. Identify fstab prerequisites: Locate or arrange a root-controlled /etc/fstab entry for a filesystem type with a registered external helper (e.g., helperpost), including user,noauto and either X-mount.idmap=b:0:<uid>:1 or X-mount.owner=<uid>,X-mount.group=<gid>,X-mount.mode=0700 options.
3. Ensure helper failure: The registered external helper (e.g., /sbin/mount.helperpost symlinked to /usr/bin/false) must exit nonzero — any transient or validation error suffices; no malicious helper is required.
4. Open raw directory FD (idmap path): As the unprivileged user, open a file descriptor to the target directory before invoking mount: exec 9< /srv/target.
5. Trigger the vulnerable mount: Run mount --target /srv/target as the unprivileged user. The helper exits 1, but libmount still executes the X-mount.idmap post-hook, creating an idmapped clone of the target at the same path with suid/exec inherited from the root filesystem.
6. Place SUID payload: Copy a SUID ELF binary (e.g., a root-shell launcher) into the mapped view (cp probe /srv/target/probe && chmod 4755 /srv/target/probe).
7. Execute via raw FD: Execute the probe through the pre-opened raw directory descriptor (/proc/self/fd/9/probe), which sees the inode as UID 0 with mode 4755, yielding EUID 0.
8. Achieve root shell: The probe calls setresuid(0,0,0) and execl("/bin/bash", ...), producing an interactive root shell (GitHub Advisory).

• Logs: mount invocations returning exit code 1 from an external helper (e.g., mount.helperpost) immediately followed by filesystem mount table changes visible in /proc/mounts or findmnt output — indicating a post-hook ran despite helper failure; audit logs (auditd) showing fchownat/chmod syscalls on root-owned directories by unprivileged UIDs.
• File System: Unexpected idmapped overmounts on directories (detectable via findmnt -o VFS-OPTIONS showing idmapped); sudden ownership changes on root-owned directories (e.g., /srv/ subdirectories changing from root:root 0755 to 1000:1000 0700); SUID binaries appearing in mount target directories owned by unprivileged users.
• Process: Unprivileged user processes spawning shells or commands with EUID 0 without sudo/su/runuser in the process tree; processes executing binaries via /proc/self/fd/<N>/ paths (raw directory FD execution).
• Network: No network indicators — this is a local privilege escalation with no network component.

Upgrade util-linux to version 2.41.6 (for the 2.39–2.41.x branch) or 2.42.3 (for the 2.42.x branch), which gate both MNT_STAGE_MOUNT_POST and MNT_STAGE_POST hook execution on a new is_mount_stage_failed() check that correctly distinguishes helper exit status from process execution status (Patch Commit, Patch Commit 2.41.x). As a workaround where patching is not immediately possible, remove or restrict X-mount.idmap and X-mount.owner/X-mount.group/X-mount.mode options from all user-accessible fstab entries, or remove the user/users option from entries that use external filesystem helpers. Distributions including Debian, Alpine, Slackware, SUSE, and Ubuntu have shipped updated packages (Red Hat Advisory).

The vulnerability was assigned and disclosed by VulnCheck and published via the util-linux GitHub Security Advisory by maintainer Karel Zak on September 2, 2026 (GitHub Advisory). It was included in coverage of Microsoft's September 2026 Patch Tuesday (as it affects the Azure Linux 3 util-linux package) by BleepingComputer (BleepingComputer). The oss-security mailing list carried a disclosure thread, and Linux distribution security roundups (SUSE, Ubuntu, Debian, Slackware) highlighted the patch (oss-sec).