| From: |
| Karel Zak <kzak-AT-redhat.com> |
| To: |
| linux-kernel-AT-vger.kernel.org, linux-fsdevel-AT-vger.kernel.org, util-linux-AT-vger.kernel.org |
| Subject: |
| [ANNOUNCE] util-linux v2.41.4 |
| Date: |
| Wed, 01 Apr 2026 13:30:06 +0200 |
| Message-ID: |
| <r6bqqytbylypey4kvj3fspb7l3o7im6dlamht5s6v2bfjs55b5@q666gfswirs6> |
| Archive-link: |
| Article |
The util-linux release v2.41.4 is now available at
http://www.kernel.org/pub/linux/utils/util-linux/v2.41
This is a security maintenance release addressing:
CVE-2026-27456 - mount(8) TOCTOU symlink attack via loop device.
The SUID mount follows symlinks when resolving loop backing file
paths. On systems where non-root users are permitted to mount loop
devices (via 'user' option in fstab), this allows access to
arbitrary files.
CWE-190 - Integer overflow in libblkid parse_dos_extended().
A crafted MBR disk image can cause uint32_t wraparound in EBR
chain processing, causing reported partitions to not match the
on-disk layout. Tools like udisks may then register a partition
at logical sector 0.
Feedback and bug reports, as always, are welcomed.
Karel
--
Karel Zak <kzak@redhat.com>
http://karelzak.blogspot.com
