util-linux 2.41.6 fixes three CVEs in mount, nsenter, unshare
The point release stops failed mount helpers from still running privileged post-mount hooks, closes a local TOCTOU on source paths, and seals fd leaks plus a leftover wall/write hostname injection.
util-linux 2.41.6 is available, closing three newly assigned CVEs in mount(8), nsenter(1), and unshare(1), along with a residual escape-sequence problem in wall(1) and write(1).
Karel Zak released the update. The highest-impact fixes sit in the mount path used by ordinary and restricted (SUID) callers.
CVE-2026-76642 covers post-mount hooks that still ran after an external mount helper exited with failure. Hooks such as idmap and ownership or mode changes therefore executed against whatever filesystem was already at the target, giving a failed mount the side effects of a successful one.
CVE-2026-78410 is a TOCTOU on the source path in restricted mode. Canonicalization and tree opening followed symlinks through user-writable directories while running with elevated credentials, so a local user could redirect a privileged mount or a subsequent ownership change to an arbitrary location.
CVE-2026-78408 addresses missing close-on-exec flags in nsenter and unshare. File descriptors opened without O_CLOEXEC could leak across exec; the release adds the flag as defense in depth.
An extra hardening lands for CVE-2024-28085. The earlier fix sanitized message bodies in wall and write but left the banner hostname unsanitized, letting an unprivileged user inject terminal escape sequences through a user-namespace hostname. Skyler Ferrante reported the gap.
The release is the current stable fix vehicle for these issues; operators who ship util-linux mount helpers, namespace tools, or wall/write should move to 2.41.6.