CVE-2026-53614High· 7.0▾ Twilightutil-linux is a random collection of Linux utilities. In util-linux 2.39.1 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility reads the attacker-controlled `LIBMOUNT_FORCE_MOUNT2` environment variable with `getenv()`, allow…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 38.5 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 16.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.1%
util-linux is a random collection of Linux utilities. In util-linux 2.39.1 through 2.41.4 and 2.42 through 2.42.1, the SUID mount utility reads the attacker-controlled LIBMOUNT_FORCE_MOUNT2 environment variable with getenv(), allowing a local low-privileged
user to force the non-atomic legacy bind-mount path. With an /etc/fstab bind mount authorized by user or users and protected by nosuid, noexec, or nodev, an attacker can race the window between the initial bind mount and the remount that applies those security flags and execute a SUID program from the temporarily unprotected mount, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-53613High· 7.0util-linux is a random collection of Linux utilities
CVE-2026-53612High· 7.0util-linux is a random collection of Linux utilities
CVE-2026-27456Medium· 4.7util-linux is a random collection of Linux utilities
CVE-2026-53615High· 8.0util-linux is a random collection of Linux utilities
CVE-2026-101785High· 8.3mysql: MySQL: Unauthorized data modification in JSON component (CVE-2026-101785)
CVE-2026-101800Medium· 6.8mysql: mysql: unauthorized data access via improper privilege controls (CVE-2026-101800)