p PatchFirst

ALPINE-CVE-2026-78410

ALPINE-CVE-2026-78410

This page contains facts from public vulnerability sources. Check the original advisory before updating.

A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.

CVSS 7.8 · High · Fix available

Published
Updated

Stack: system

Affected products and versions

  • util-linux Alpine:v3.22

    Affected ranges
    • ECOSYSTEM: < 2.41.6-r0

    Update to 2.41.6-r0

  • util-linux Alpine:v3.23

    Affected ranges
    • ECOSYSTEM: < 2.41.6-r0

    Update to 2.41.6-r0

  • util-linux Alpine:v3.24

    Affected ranges
    • ECOSYSTEM: < 2.42.3-r0

    Update to 2.42.3-r0

Original sources

Check your server →