CVE-2026-78410: 
CBL Mariner vulnerability analysis and mitigation

CVE-2026-78410 is a Time-of-Check Time-of-Use (TOCTOU) race condition vulnerability in util-linux that enables local privilege escalation via restricted bind mount redirection. Affected versions are util-linux v2.39 through v2.42.2 (the X-mount.owner/group/mode feature was introduced in v2.39). The vulnerability was reported by Zhuorao Yang (Huawei Cloud) / Alex0Young, disclosed publicly on September 2, 2026, and fixed in v2.41.6 and v2.42.3. It carries a CVSS v3.1 base score of 7.8 (High) (Red Hat CVE, GitHub Advisory).

The root cause (CWE-367: TOCTOU Race Condition) lies in libmount's restricted bind mount handling: the fstab-authorized bind source path is canonicalized as a string by mnt_context_prepare_srcpath() but is never pinned to a file descriptor before the privileged mount operation. This creates a window between authorization and execution during which a local user who owns or can write to an ancestor directory of the fstab bind source can atomically replace it with a symlink pointing to an attacker-chosen host directory (e.g., rm -rf /tmp/ul_e2e/user/safe && ln -s /tmp/ul_e2e/sensitive /tmp/ul_e2e/user/safe). When the fstab entry also specifies X-mount.owner=, X-mount.group=, or X-mount.mode=, the post-mount hook in hook_owner.c applies root-privileged fchownat()/chmod() to the mounted root fd — which, for a bind mount, is the inode of the attacker-redirected source. The attack is distinct from the loop backing-file TOCTOU and from CVE-2026-76642, as it specifically targets the source-side pathname re-resolution via open_tree(AT_FDCWD, source, OPEN_TREE_CLONE | ...) (GitHub Advisory, Red Hat Bugzilla).

A local unprivileged user can cause root to apply chown or chmod to an arbitrary host directory not authorized by the fstab entry, constituting a high-impact integrity violation. If the redirected path is security-sensitive (e.g., a service configuration directory, plugin directory, or root-controlled file), the attacker can modify ownership or permissions to enable further privilege escalation — potentially achieving a root shell. Confidentiality and availability are also rated High, as gaining write access to root-controlled paths can expose sensitive data and destabilize system services (GitHub Advisory, Red Hat CVE).

A detailed proof-of-concept with step-by-step reproduction instructions was published in the upstream GitHub Security Advisory (GHSA-rh77-686x-2f2m) on September 2, 2026, and is classified as a real exploit with high confidence by Feedly's NVD SSVC analysis (GitHub Advisory). There is no evidence of in-the-wild exploitation as of the report date, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.095%, reflecting low but non-negligible exploitation probability. The attack is not automatable (requires local access and a specific fstab configuration), but is reliable once preconditions are met — the TOCTOU window is exploitable with a simple symlink swap rather than a tight timing race (Red Hat CVE).

1. Identify a vulnerable target: Confirm the system runs util-linux v2.39–v2.42.2 with SUID mount(8), and locate an /etc/fstab entry permitting an unprivileged user to perform a bind/rbind mount from a path under a user-writable ancestor, with X-mount.owner=, X-mount.group=, or X-mount.mode= set.
2. Set up the environment: As the unprivileged user (e.g., ulhead), ensure the authorized fstab bind source directory exists: mkdir -p /tmp/ul_e2e/user/safe. The fstab entry should resemble: /tmp/ul_e2e/user/safe /tmp/ul_e2e/mnt none bind,user,noauto,X-mount.owner=ulhead,X-mount.group=ulhead 0 0.
3. Identify the target sensitive path: Choose a root-owned, restricted directory to redirect the mount to (e.g., /tmp/ul_e2e/sensitive owned by root with mode 0700).
4. Replace the authorized source with a symlink: Before the privileged mount operation executes, atomically replace the authorized source with a symlink to the sensitive path: runuser -u ulhead -- sh -c 'rm -rf /tmp/ul_e2e/user/safe && ln -s /tmp/ul_e2e/sensitive /tmp/ul_e2e/user/safe'.
5. Trigger the privileged mount: Invoke mount /tmp/ul_e2e/mnt as the unprivileged user (or use a compiled harness that calls mnt_context_mount() in restricted mode). libmount re-resolves the source pathname, follows the symlink, and opens the sensitive directory via open_tree(AT_FDCWD, source, OPEN_TREE_CLONE | ...).
6. Observe privilege escalation: The X-mount.owner/group post-hook applies root-privileged fchownat()/chmod() to the mounted root fd, which is the redirected sensitive inode. Verify: stat -c '%n uid=%u gid=%g mode=%a' /tmp/ul_e2e/sensitive — ownership now reflects the unprivileged user.
7. Leverage the modified permissions: With ownership or mode changed on the sensitive directory, the attacker can now read, write, or execute files within it, enabling further privilege escalation (e.g., modifying root-controlled configuration or service files) (GitHub Advisory).

• File System: Unexpected symlinks in user-writable directories that are also fstab bind mount sources (e.g., a directory replaced by a symlink pointing to a sensitive root-owned path); unexpected ownership or permission changes on root-controlled directories (detectable via stat or file integrity monitoring tools like AIDE/Tripwire).
• Logs: Audit log entries (auditd) showing fchownat() or chmod() syscalls by root on paths not expected to be modified, correlated with mount syscall activity from an unprivileged UID; /var/log/auth.log or secure entries for mount invocations by non-root users.
• Process: Unusual mount process invocations by unprivileged users followed immediately by ownership changes on sensitive directories; child processes of mount(8) accessing paths outside the expected mount source.
• Network: No direct network indicators — this is a local privilege escalation; however, post-exploitation activity (e.g., outbound connections from newly privileged processes) may appear in network logs (GitHub Advisory, Red Hat CVE).

Upgrade util-linux to v2.41.6 or v2.42.3 (or later), which pin the bind mount source with a file descriptor before the privileged operation. Red Hat has released a patched RPM (version 2.42.2-3.4.hum1) for Red Hat Hardened Images via RHSA-2026:63162; Slackware and Alpine Linux have also shipped updates. As an interim workaround, do not configure /etc/fstab bind or rbind entries that combine user/noauto (unprivileged user mounts) with X-mount.owner=, X-mount.group=, or X-mount.mode= when the bind source path is below a user-writable ancestor directory. Additionally, audit existing fstab entries for this combination and restrict write access to bind source parent directories (Red Hat CVE, Red Hat Errata, GitHub Advisory).

The vulnerability was acknowledged by the util-linux upstream maintainer Karel Zak, who published the GitHub Security Advisory (GHSA-rh77-686x-2f2m) on September 2, 2026. Red Hat Product Security assigned a High severity rating and provided detailed technical analysis including affected version ranges and mitigation guidance. The vulnerability was included in Microsoft's September 2026 Patch Tuesday coverage (as it affects WSL/Linux subsystem components), which was reported by BleepingComputer. Community discussion appeared on oss-security mailing lists and social media (Mastodon/RedPacketSecurity), with general consensus that the reliable symlink-based exploitation makes this a meaningful local privilege escalation risk on systems with the specific fstab configuration (GitHub Advisory, Red Hat CVE).