Mount Helper Exit Status Bypass Enables Privilege Escalation

CVE-2026-76642 is a privilege escalation vulnerability in util-linux that exploits a race condition in the mount system. When mount helpers fail, the vulnerable versions continue executing post-mount hooks (X-mount.idmap and X-mount.owner) without verifying the helper's exit status. This allows unprivileged users to manipulate filesystem operations on pre-existing mounts, potentially inheriting SUID bits or modifying inode permissions. Any system running util-linux 2.41.5, 2.42.2, or similar affected versions is at risk, particularly in multi-user environments or container deployments where unprivileged users can trigger mount operations.

While this CVE lacks direct MITRE ATT&CK mapping, Casky's 754 security skills enable detection of the underlying attack patterns through privilege escalation and persistence behaviors. Practitioners using Casky would identify this through skills mapping to T1547 (Boot or Logon Autostart Execution), T1548 (Abuse Elevation Control Mechanism), and T1562 (Impair Defenses). The attack pattern—unprivileged process manipulation of privileged filesystem operations—would surface as anomalous mount syscall sequences, unexpected hook execution contexts, or privilege boundary violations. Extended reasoning across Casky's skill framework would correlate failed helper processes continuing to execute post-mount hooks, a telltale indicator of exit status bypass exploitation that security teams should escalate for immediate investigation.