| From: |
| Karel Zak <kzak-AT-redhat.com> |
| To: |
| linux-kernel-AT-vger.kernel.org, linux-fsdevel-AT-vger.kernel.org, util-linux-AT-vger.kernel.org |
| Subject: |
| [ANNOUNCE] util-linux v2.42.2 and v2.41.5 |
| Date: |
| Tue, 16 Jun 2026 14:34:23 +0200 |
| Message-ID: |
| <c2fo4x3lcppsj77k564i4qodmon3wagx47qf4mqwjwdtiplupg@jmaqrlzp273h> |
| Archive-link: |
| Article |
The util-linux releases v2.42.2 and v2.41.5 are now available at
https://www.kernel.org/pub/linux/utils/util-linux/v2.42/
https://www.kernel.org/pub/linux/utils/util-linux/v2.41/
Both releases contain security fixes for libmount and libblkid:
CVE-2026-53613 - mount(8) TOCTOU race on target path
CVE-2026-53612 - mount(8) TOCTOU race on post-mount owner/mode change
CVE-2026-53614 - mount(8) SUID bypass via LIBMOUNT_FORCE_MOUNT2
libblkid use-after-free in nested partition probing
v2.42.2 additionally includes a follow-up fix for CVE-2026-27456
(loop device symlink attack) -- the v2.42.1 fix used O_NOFOLLOW
which only rejects symlinks at the last path component; this update
uses openat2(RESOLVE_NO_SYMLINKS) to reject symlinks at any component.
Note for v2.41 downstream maintainers: the same loopdev follow-up
fix for CVE-2026-27456 is available on the stable/v2.41 branch
(commit 2dacaf3ee) but did not make it into the v2.41.5 tarball.
Please cherry-pick it into your builds.
Release notes:
https://www.kernel.org/pub/linux/utils/util-linux/v2.42/v...
https://www.kernel.org/pub/linux/utils/util-linux/v2.41/v...
Feedback and bug reports, as always, are welcomed.
Karel
--
Karel Zak <kzak@redhat.com>
http://karelzak.blogspot.com
