CVE-2026-78410: Red Hat Enterprise Linux 10

High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days.

A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.

Affected products

• Red Hat Red Hat Enterprise Linux 10
• Red Hat Red Hat Enterprise Linux 7
• Red Hat Red Hat Enterprise Linux 8
• Red Hat Red Hat Enterprise Linux 9
• Red Hat Red Hat Hardened Images: before 2.42.2-3.4.hum1 (fixed in 2.42.2-3.4.hum1)
• Red Hat Red Hat Openshift Container Platform 4

Published 2026-09-02. Last modified 2026-09-04.