util-linux-2.42.4 (Security Update)

[Bruce Dubbs]

New point version.

util-linux 2.42.3 Release Notes

Security fixes:

CVE-2026-76642 - mount(8) post-mount hooks execute after helper failure.

When an external mount.<type> helper exits nonzero, post-mount hooks (X-mount.idmap, X-mount.owner/group/mode) still execute as if the mount had succeeded, allowing privileged operations on the pre-existing target filesystem.

CVE-2026-78410 - mount(8) TOCTOU race on source path.

In restricted (SUID, non-root) mode, the source path is canonicalized with realpath() as euid=0, following symlinks through user-writable directories. Additionally, open_tree() follows symlinks in intermediate path components. A local attacker can redirect a privileged mount or post-mount ownership change to an arbitrary path.

CVE-2026-78409 - mount(8) X-mount.subdir symlink escape.

The open_tree() call used to open a subdirectory on a detached mount follows symlinks in intermediate path components, allowing escape from the detached tree.

CVE-2026-78408 - nsenter(1), unshare(1) file descriptor leak.

File descriptors in nsenter and unshare were not created with O_CLOEXEC, potentially leaking them across exec. Added O_CLOEXEC as defense in depth.

wall(1), write(1) - hostname escape sequence injection.

The CVE-2024-28085 fix sanitized only message bodies; the banner headers still interpolated the system hostname without sanitization. An unprivileged user can inject terminal escape sequences via a user namespace hostname. Additional fix for CVE-2024-28085. Reported-by: Skyler Ferrante

[Bruce Dubbs]

This probably needs a sed (adapted from upstream):

sed -i '/namespace.h/i #include "fileutils.h"' libmount/src/hook_idmap.c

[Bruce Dubbs]

There is a new version coming soon due to an incomplete CVE-2026-78408 fix. The wait should not be long.

[Bruce Dubbs]

Now version 2.42.4.

util-linux 2.42.4 Release Notes

Changes between v2.42.3 and v2.42.4:

libblkid:

• minix don't detect erofs images as minix

lib/fileutils:

• add safe FD-path and no-symlink helpers
• fix RESOLVE_NO_SYMLINKS fallback value
• fix unused parameter warnings without SYS_openat2

libmount:

• add mnt_fs_fetch_ids() and populate uniq_id for utab
• use fchmodat2() for X-mount.mode=
• restore the original namespace on error paths
• secure the idmapped mount replacement
• pin the legacy mount target and bind/move source
• harden restricted mount targets and post-mount handling
• fix X-mount.idmap ID names in code and man page
• use USE_LIBMOUNT_MOUNTFD_SUPPORT for idmap hook
• add missing fileutils.h include to hook_idmap.c

mount:

• fix grammar and typo in X-mount.idmap documentation

nsenter:

• close cgroup.procs fd after join to prevent authority leak [CVE-2026-78408]

po:

• update sv.po (from translationproject.org)
• update nl.po (from translationproject.org)

po-man:

• update sv.po (from translationproject.org)

tools:

• add non-newmount.conf config-gen profile