{"id":"CVE-2026-78410","aliases":[],"cve":{"records":[{"id":"CVE-2026-78410","source":"redhat","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-08-24T14:40:20.201Z","published":"2026-09-02T15:05:34.414Z","modified":"2026-11-05T02:43:54.671Z"}],"publishers":[{"name":"redhat","role":"CNA","organizationId":"53f830b8-0a3f-465b-8143-3b8a9948e749","modified":"2026-11-05T02:43:54.671Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-09-04T18:43:10.663Z"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:63162","tags":["vendor-advisory","x_refsource_REDHAT"],"source":"redhat"},{"url":"https://access.redhat.com/errata/RHSA-2026:93461","tags":["vendor-advisory","x_refsource_REDHAT"],"source":"redhat"},{"url":"https://access.redhat.com/errata/RHSA-2026:95365","tags":["vendor-advisory","x_refsource_REDHAT"],"source":"redhat"},{"url":"https://access.redhat.com/security/cve/CVE-2026-78410","tags":["vdb-entry","x_refsource_REDHAT"],"source":"redhat"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2522684","tags":["issue-tracking","x_refsource_REDHAT"],"source":"redhat"},{"url":"https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m","tags":[],"source":"redhat"},{"url":"https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m","tags":["exploit"],"source":"CISA-ADP"}],"weaknesses":[{"id":"CWE-367","description":"Time-of-check Time-of-use (TOCTOU) Race Condition","source":"redhat"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-09-04T18:43:04.874138Z","decisions":[{"name":"Exploitation","value":"poc"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"total"}]}]},"title":"Util-linux: util-linux: restricted bind mounts do not pin the source, allowing x-mount.owner/group/mode redirection","titleSource":"redhat","descriptionSource":"redhat","description":"A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.","score":7.8,"severity":"high","published":"2026-09-02T15:05:34.414Z","modified":"2026-11-05T02:43:54.671Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Red Hat","name":"Red Hat Enterprise Linux 10","platforms":[],"versions":[{"version":"0:2.40.2-18.el10_2.20","status":"unaffected","lessThan":"*","versionType":"rpm"}],"defaultStatus":"affected","cpes":["cpe:/o:redhat:enterprise_linux:10.2"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-78410"},{"vendor":"Red Hat","name":"Red Hat Cost Management On-Premise 1","platforms":[],"versions":[{"version":"1793825318","status":"unaffected","lessThan":"*","versionType":"rpm"}],"defaultStatus":"affected","cpes":["cpe:/a:redhat:cost_management_on_premise:1::el10"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-78410"},{"vendor":"Red Hat","name":"Red Hat Hardened Images","platforms":[],"versions":[{"version":"2.42.2-3.4.hum1","status":"unaffected","lessThan":"*","versionType":"rpm"}],"defaultStatus":"affected","cpes":["cpe:/a:redhat:hummingbird:1"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-78410"},{"vendor":"Red Hat","name":"Red Hat Enterprise Linux 7","platforms":[],"versions":[],"defaultStatus":"unaffected","cpes":["cpe:/o:redhat:rhel_els:7"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-78410"},{"vendor":"Red Hat","name":"Red Hat Enterprise Linux 8","platforms":[],"versions":[],"defaultStatus":"unaffected","cpes":["cpe:/a:redhat:enterprise_linux:8"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-78410"},{"vendor":"Red Hat","name":"Red Hat Enterprise Linux 9","platforms":[],"versions":[],"defaultStatus":"unaffected","cpes":["cpe:/a:redhat:enterprise_linux:9"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-78410"},{"vendor":"Red Hat","name":"Red Hat Enterprise Linux 9","platforms":[],"versions":[],"defaultStatus":"unaffected","cpes":["cpe:/a:redhat:enterprise_linux:9"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-78410"},{"vendor":"Red Hat","name":"Red Hat Enterprise Linux 9","platforms":[],"versions":[],"defaultStatus":"unaffected","cpes":["cpe:/a:redhat:enterprise_linux:9"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-78410"},{"vendor":"Red Hat","name":"Red Hat OpenShift Container Platform 4","platforms":[],"versions":[],"defaultStatus":"unaffected","cpes":["cpe:/a:redhat:openshift:4"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-78410"},{"vendor":"Red Hat","name":"Red Hat OpenShift Container Platform 4","platforms":[],"versions":[],"defaultStatus":"unaffected","cpes":["cpe:/a:redhat:openshift:4"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-78410"},{"vendor":"Red Hat","name":"Red Hat OpenShift Container Platform 5","platforms":[],"versions":[],"defaultStatus":"unaffected","cpes":["cpe:/a:redhat:openshift:5"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-78410"}],"remediation":[{"text":"Upgrade to util-linux v2.41.6, v2.42.3, or later. Until a fix is applied, do not allow unprivileged /etc/fstab bind or rbind entries that also specify X-mount.owner, X-mount.group, or X-mount.mode, especially when the bind source is below a user-writable ancestor.","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-78410"}],"references":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/errata/RHSA-2026:93461","https://access.redhat.com/errata/RHSA-2026:95365","https://access.redhat.com/security/cve/CVE-2026-78410","https://bugzilla.redhat.com/show_bug.cgi?id=2522684","https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m"],"sources":[{"name":"CVE","id":"CVE-2026-78410","modified":"2026-11-05T02:43:54.671Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-78410"}],"assessments":[{"source":"redhat","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8}],"sourceAffected":[],"observedAt":"2026-11-05T03:15:21.764Z","kev":{"status":"not-listed","checkedAt":"2026-11-05T07:00:31.683Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-30T15:40:39.599Z","attemptedAt":"2026-10-30T15:40:39.599Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-10-30T15:40:38.503Z","attemptedAt":"2026-10-30T15:40:38.503Z"},{"source":"EUVD","status":"refresh-failed","attemptedAt":"2026-10-30T15:40:36.792Z"},{"source":"EPSS","status":"available","checkedAt":"2026-10-30T15:40:40.300Z","attemptedAt":"2026-10-30T15:40:40.300Z"}],"evidence":[{"source":"NVD","id":"CVE-2026-78410","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78410","modified":"2026-10-30T14:17:10.000","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","checkedAt":"2026-10-30T15:40:39.599Z"},{"source":"FIRST EPSS","id":"CVE-2026-78410","url":"https://www.first.org/epss/","probability":0.00162,"percentile":0.05348,"date":"2026-10-30","checkedAt":"2026-10-30T15:40:40.300Z"}],"aiSummary":{"text":"A flaw in util-linux allows a local unprivileged user to redirect SUID mount(8) to bind another host directory if they can replace the authorized source or a writable ancestor. The vulnerability affects restricted bind mounts that do not pin the source path from fstab. If the fstab entry sets X-mount.owner, X-mount.group, or X-mount.mode, root may change ownership or mode on the redirected inode.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-05T03:16:04.347Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-78410"}]}}