{"schema_version":"1","data":[{"id":28955,"advisory_id":"a2bba308-af82-459a-9cc1-2ec4631cc96e","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53614","source_published_at":"2026-10-14T15:40:53.674+00:00","published_at":"2026-10-25T07:51:09.853891+00:00","extraction_method":"structured","technologies":["core-cve","util-linux"],"cve_ids":["CVE-2026-53614"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"util-linux LIBMOUNT_FORCE_MOUNT2 allows nosuid and noexec bypass","summary":"util-linux is a random collection of Linux utilities. In util-linux 2.39.1 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility reads the attacker-controlled `LIBMOUNT_FORCE_MOUNT2` environment variable with `getenv()`, allowing a local low-privileged user to force the non-atomic legacy bind-mount path. With an `/etc/fstab` bind mount authorized by `user` or `users` and protected by `nosuid`, `noexec`, or `nodev`, an attacker can race the window between the initial bind mount and the remount that applies those security flags and execute a SUID program from the temporarily unprotected mount, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2.","evidence":"cve:CVE-2026-53614","products":[{"name":{"value":"util-linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-53614","aliases":["CVE-2026-53614"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7,"attackVector":"LOCAL","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"util-linux","product":"util-linux","versions":[{"status":"affected","version":">= 2.39.1, < 2.41.5"},{"status":"affected","version":">= 2.42, < 2.42.2"}]}],"modified":"2026-10-15T15:08:08.295Z","provider":"cve","references":["https://github.com/util-linux/util-linux/security/advisories/GHSA-67r7-8m5w-22wx","https://github.com/util-linux/util-linux/commit/31e37c1c7dcf25b76ccf41391fe934a75644c661","https://github.com/util-linux/util-linux/commit/53ff0fcdab12d69c60c971c69a3d0d173fa46ca9","https://github.com/util-linux/util-linux/commit/9cbfb823500f510b34767edabd3ffd5b436987b4","https://github.com/util-linux/util-linux/commit/cc81bbcec598cb91f0eb8456282f33eed820ed5f","https://github.com/util-linux/util-linux/commit/fd6b4d94ff013dc7ed680d4e864610da5b9751f1","https://github.com/util-linux/util-linux/releases/tag/v2.41.5","https://github.com/util-linux/util-linux/releases/tag/v2.42.2"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-53614","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-15T13:11:43.965210Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T15:08:08.295Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-14T15:40:53.674Z"}}},"related_cves":[{"value":"CVE-2026-53614","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":28954,"advisory_id":"5a0acbb3-25c8-4ad3-bf96-4e82abdb9a75","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53615","source_published_at":"2026-10-14T15:56:45.31+00:00","published_at":"2026-10-25T07:51:09.2587+00:00","extraction_method":"structured","technologies":["core-cve","util-linux"],"cve_ids":["CVE-2026-53615"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"util-linux libblkid DOS extended-partition overflow produces invalid partition metadata","summary":"util-linux is a random collection of Linux utilities. Before util-linux 2.41.4, `parse_dos_extended()` in `libblkid/src/partitions/dos.c` computes an extended-partition start sector with 32-bit addition and does not apply the extended-area bounds checks to the first two EBR entries. A local attacker who causes a crafted DOS extended-partition disk image or removable medium to be probed can wrap `cur_start + start` to sector zero and cause libblkid to report a false partition overlapping the MBR. This directly compromises the integrity of the reported partition metadata; disk modification or availability loss requires a separate downstream consumer to act on that metadata. This issue is fixed in 2.41.4.","evidence":"cve:CVE-2026-53615","products":[{"name":{"value":"util-linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-53615","aliases":["CVE-2026-53615"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8,"attackVector":"LOCAL","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"util-linux","product":"util-linux","versions":[{"status":"affected","version":"< 2.41.4"}]}],"modified":"2026-10-15T15:07:57.462Z","provider":"cve","references":["https://github.com/util-linux/util-linux/security/advisories/GHSA-h4rw-gv36-wmp5","https://github.com/util-linux/util-linux/commit/05c2dbadf34cc74192287f377904afaaf4061623","https://github.com/util-linux/util-linux/commit/a2d858176b609ab5b8535021a3af9cd302d23d31","https://github.com/util-linux/util-linux/commit/e9d544d013267ea86b70ee8ff78abd280e6641af","https://github.com/util-linux/util-linux/releases/tag/v2.41.4"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-53615","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-14T16:11:25.315520Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T15:07:57.462Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-14T15:56:45.310Z"}}},"related_cves":[{"value":"CVE-2026-53615","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":28953,"advisory_id":"f95dee25-05f5-44c4-97b1-99afb04f7747","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53613","source_published_at":"2026-10-14T14:52:56.063+00:00","published_at":"2026-10-25T07:51:07.758224+00:00","extraction_method":"structured","technologies":["core-cve","util-linux"],"cve_ids":["CVE-2026-53613"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"util-linux mount target TOCTOU allows local privilege escalation","summary":"util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy `mount(2)` path is used without `/proc`, restricted non-root `mount` requests validate an `/etc/fstab` target before the mount operation re-resolves that pathname. A local low-privileged user authorized by an fstab `user` or `users` entry whose target has an attacker-writable ancestor can use `renameat2(RENAME_EXCHANGE)` to swap a path component and redirect an authorized mount to a root-owned location, such as mounting attacker-controlled content over `/etc/sudoers.d`, and thereby gain root privileges. Versions 2.41.5 and 2.42.2 pin targets for the new mount API, and 2.42.4 pins legacy targets through `/proc/self/fd`; the documented legacy fallback without `/proc` remains affected.","evidence":"cve:CVE-2026-53613","products":[{"name":{"value":"util-linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-53613","aliases":["CVE-2026-53613"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7,"attackVector":"LOCAL","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"util-linux","product":"util-linux","versions":[{"status":"affected","version":">= 2.17, <= 2.41.6"},{"status":"affected","version":">= 2.42, <= 2.42.4"}]}],"modified":"2026-10-15T15:08:26.914Z","provider":"cve","references":["https://github.com/util-linux/util-linux/security/advisories/GHSA-8gj5-72r3-428g","https://github.com/util-linux/util-linux/commit/0b010025a0e429bc80355c94db86a843395d49e2","https://github.com/util-linux/util-linux/commit/0d3d55975aa3492c62fd345eac38f41cd166c0b0","https://github.com/util-linux/util-linux/commit/2c773f336134acf016e639abb6f12ba7341fe4b8","https://github.com/util-linux/util-linux/commit/39fef62bf3226abb6bb018fa8750afa0327e84b4","https://github.com/util-linux/util-linux/commit/472cc3fb2d4d47cca7aab2e0b59eb3fb8a9359ec","https://github.com/util-linux/util-linux/commit/646fb66603d10a7ac337e14f566f1af48e3107c9","https://github.com/util-linux/util-linux/commit/708d1b3c51932dc5ba8082c7368187715e6a8d78","https://github.com/util-linux/util-linux/commit/78a860982e036f38fe9c0b3344998df5ac2c2ff5","https://github.com/util-linux/util-linux/commit/85d16b341f7232c9dbb4884b632e1e956584bee9","https://github.com/util-linux/util-linux/commit/a9508d216eb8977979102782672e0470cc9bf2a2","https://github.com/util-linux/util-linux/releases/tag/v2.41.5","https://github.com/util-linux/util-linux/releases/tag/v2.42.2","https://github.com/util-linux/util-linux/releases/tag/v2.42.4"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-53613","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-15T13:11:45.430649Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T15:08:26.914Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-14T14:52:56.063Z"}}},"related_cves":[{"value":"CVE-2026-53613","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":23059,"advisory_id":"e2bcff46-f6a2-4cbd-b6c6-b6167287b2bb","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-14104","source_published_at":"2025-12-05T16:22:09.283+00:00","published_at":"2026-10-25T06:12:37.741739+00:00","extraction_method":"structured","technologies":["cert-manager-support-for-red-hat-openshift-release-1-18","core-cve","red-hat-ceph-storage-7","red-hat-ceph-storage-8","red-hat-ceph-storage-9","red-hat-enterprise-linux-10","red-hat-enterprise-linux-6","red-hat-enterprise-linux-7","red-hat-enterprise-linux-8","red-hat-enterprise-linux-9","red-hat-hardened-images","red-hat-insights-proxy-1-5","red-hat-openshift-container-platform-4","red-hat-update-infrastructure-5","util-linux"],"cve_ids":["CVE-2025-14104"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Util-linux: util-linux: heap buffer overread in setpwnam() when processing 256-byte usernames","summary":"A flaw was found in util-linux. This vulnerability allows a heap buffer overread when processing 256-byte usernames, specifically within the `setpwnam()` function, affecting SUID (Set User ID) login-utils utilities writing to the password database.","evidence":"cve:CVE-2025-14104","products":[{"name":{"value":"util-linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Enterprise Linux 10","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Enterprise Linux 8","evidence":"/containers/cna/affected/2/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Enterprise Linux 8","evidence":"/containers/cna/affected/3/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Enterprise Linux 9","evidence":"/containers/cna/affected/4/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Enterprise Linux 9","evidence":"/containers/cna/affected/5/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Cert Manager support for Red Hat OpenShift release 1.18","evidence":"/containers/cna/affected/6/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Cert Manager support for Red Hat OpenShift release 1.18","evidence":"/containers/cna/affected/7/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Cert Manager support for Red Hat OpenShift release 1.18","evidence":"/containers/cna/affected/8/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Cert Manager support for Red Hat OpenShift release 1.18","evidence":"/containers/cna/affected/9/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Cert Manager support for Red Hat OpenShift release 1.18","evidence":"/containers/cna/affected/10/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Ceph Storage 7","evidence":"/containers/cna/affected/11/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Ceph Storage 8","evidence":"/containers/cna/affected/12/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Ceph Storage 9","evidence":"/containers/cna/affected/13/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Hardened Images","evidence":"/containers/cna/affected/14/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Insights proxy 1.5","evidence":"/containers/cna/affected/15/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Update Infrastructure 5","evidence":"/containers/cna/affected/16/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Update Infrastructure 5","evidence":"/containers/cna/affected/17/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Update Infrastructure 5","evidence":"/containers/cna/affected/18/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Update Infrastructure 5","evidence":"/containers/cna/affected/19/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Enterprise Linux 6","evidence":"/containers/cna/affected/20/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Enterprise Linux 7","evidence":"/containers/cna/affected/21/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Container Platform 4","evidence":"/containers/cna/affected/22/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Container Platform 4","evidence":"/containers/cna/affected/23/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2025-14104","aliases":["CVE-2025-14104"],"metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Moderate","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.1,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"util-linux","product":"util-linux","versions":[{"status":"affected","version":"0","lessThan":"2.41.3","versionType":"semver"}],"packageName":"util-linux","collectionURL":"https://github.com/util-linux/util-linux","defaultStatus":"unaffected"},{"cpes":["cpe:/o:redhat:enterprise_linux:10.1"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","versions":[{"status":"unaffected","version":"0:2.40.2-15.el10_1","lessThan":"*","versionType":"rpm"}],"packageName":"util-linux","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:enterprise_linux:8::appstream","cpe:/a:redhat:enterprise_linux:8::crb","cpe:/o:redhat:enterprise_linux:8::baseos"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","versions":[{"status":"unaffected","version":"0:2.32.1-48.el8_10","lessThan":"*","versionType":"rpm"}],"packageName":"util-linux","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:enterprise_linux:8::appstream","cpe:/a:redhat:enterprise_linux:8::crb","cpe:/o:redhat:enterprise_linux:8::baseos"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","versions":[{"status":"unaffected","version":"0:2.32.1-48.el8_10","lessThan":"*","versionType":"rpm"}],"packageName":"util-linux","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/a:redhat:enterprise_linux:9::crb","cpe:/o:redhat:enterprise_linux:9::baseos"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","versions":[{"status":"unaffected","version":"0:2.37.4-21.el9_7","lessThan":"*","versionType":"rpm"}],"packageName":"util-linux","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/a:redhat:enterprise_linux:9::crb","cpe:/o:redhat:enterprise_linux:9::baseos"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","versions":[{"status":"unaffected","version":"0:2.37.4-21.el9_7","lessThan":"*","versionType":"rpm"}],"packageName":"util-linux","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:cert_manager:1.18::el9"],"vendor":"Red Hat","product":"Cert Manager support for Red Hat OpenShift release 1.18","versions":[{"status":"unaffected","version":"1791459707","lessThan":"*","versionType":"rpm"}],"packageName":"cert-manager/jetstack-cert-manager-acmesolver-rhel9","collectionURL":"https://catalog.redhat.com/software/containers/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:cert_manager:1.18::el9"],"vendor":"Red Hat","product":"Cert Manager support for Red Hat OpenShift release 1.18","versions":[{"status":"unaffected","version":"1791459711","lessThan":"*","versionType":"rpm"}],"packageName":"cert-manager/jetstack-cert-manager-rhel9","collectionURL":"https://catalog.redhat.com/software/containers/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:cert_manager:1.18::el9"],"vendor":"Red Hat","product":"Cert Manager support for Red Hat OpenShift release 1.18","versions":[{"status":"unaffected","version":"1791459759","lessThan":"*","versionType":"rpm"}],"packageName":"cert-manager/cert-manager-istio-csr-rhel9","collectionURL":"https://catalog.redhat.com/software/containers/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:cert_manager:1.18::el9"],"vendor":"Red Hat","product":"Cert Manager support for Red Hat OpenShift release 1.18","versions":[{"status":"unaffected","version":"1789029076","lessThan":"*","versionType":"rpm"}],"packageName":"cert-manager/cert-manager-operator-rhel9","collectionURL":"https://catalog.redhat.com/software/containers/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:cert_manager:1.18::el9"],"vendor":"Red Hat","product":"Cert Manager support for Red Hat OpenShift release 1.18","versions":[{"status":"unaffected","version":"1791966259","lessThan":"*","versionType":"rpm"}],"packageName":"cert-manager/cert-manager-operator-bundle","collectionURL":"https://catalog.redhat.com/software/containers/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:ceph_storage:7::el9"],"vendor":"Red Hat","product":"Red Hat Ceph Storage 7","versions":[{"status":"unaffected","version":"1770632724","lessThan":"*","versionType":"rpm"}],"packageName":"rhceph/rhceph-7-rhel9","collectionURL":"https://catalog.redhat.com/software/containers/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:ceph_storage:8::el9"],"vendor":"Red Hat","product":"Red Hat Ceph Storage 8","versions":[{"status":"unaffected","version":"1770630907","lessThan":"*","versionType":"rpm"}],"packageName":"rhceph/rhceph-8-rhel9","collectionURL":"https://catalog.redhat.com/software/containers/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:ceph_storage:9::el10"],"vendor":"Red Hat","product":"Red Hat Ceph Storage 9","versions":[{"status":"unaffected","version":"1771816028","lessThan":"*","versionType":"rpm"}],"packageName":"rhceph/rhceph-9-rhel9","collectionURL":"https://catalog.redhat.com/software/containers/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:hummingbird:1"],"vendor":"Red Hat","product":"Red Hat Hardened Images","versions":[{"status":"unaffected","version":"2.42-7.1.hum1","lessThan":"*","versionType":"rpm"}],"packageName":"util-linux-main","collectionURL":"https://catalog.redhat.com/software/containers/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:insights_proxy:1.5::el9"],"vendor":"Red Hat","product":"Red Hat Insights proxy 1.5","versions":[{"status":"unaffected","version":"1770740405","lessThan":"*","versionType":"rpm"}],"packageName":"insights-proxy/insights-proxy-container-rhel9","collectionURL":"https://catalog.redhat.com/software/containers/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:rhui:5::el9"],"vendor":"Red Hat","product":"Red Hat Update Infrastructure 5","versions":[{"status":"unaffected","version":"1770646925","lessThan":"*","versionType":"rpm"}],"packageName":"rhui5/installer-rhel9","collectionURL":"https://catalog.redhat.com/software/containers/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:rhui:5::el9"],"vendor":"Red Hat","product":"Red Hat Update Infrastructure 5","versions":[{"status":"unaffected","version":"1773670073","lessThan":"*","versionType":"rpm"}],"packageName":"rhui5/cds-rhel9","collectionURL":"https://catalog.redhat.com/software/containers/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:rhui:5::el9"],"vendor":"Red Hat","product":"Red Hat Update Infrastructure 5","versions":[{"status":"unaffected","version":"1773672059","lessThan":"*","versionType":"rpm"}],"packageName":"rhui5/haproxy-rhel9","collectionURL":"https://catalog.redhat.com/software/containers/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:rhui:5::el9"],"vendor":"Red Hat","product":"Red Hat Update Infrastructure 5","versions":[{"status":"unaffected","version":"1773670137","lessThan":"*","versionType":"rpm"}],"packageName":"rhui5/rhua-rhel9","collectionURL":"https://catalog.redhat.com/software/containers/","defaultStatus":"affected"},{"cpes":["cpe:/o:redhat:enterprise_linux:6"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","packageName":"util-linux-ng","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/o:redhat:enterprise_linux:7"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","packageName":"util-linux","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift:4"],"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift/ose-rhel-coreos-8","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift:4"],"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift/ose-rhel-coreos-9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"}],"modified":"2026-10-14T19:31:48.792Z","provider":"cve","references":["https://access.redhat.com/errata/RHSA-2026:1696","https://access.redhat.com/errata/RHSA-2026:1852","https://access.redhat.com/errata/RHSA-2026:1913","https://access.redhat.com/errata/RHSA-2026:2485","https://access.redhat.com/errata/RHSA-2026:2563","https://access.redhat.com/errata/RHSA-2026:2737","https://access.redhat.com/errata/RHSA-2026:2800","https://access.redhat.com/errata/RHSA-2026:3406","https://access.redhat.com/errata/RHSA-2026:4943","https://access.redhat.com/errata/RHSA-2026:7180","https://access.redhat.com/errata/RHSA-2026:82347","https://access.redhat.com/errata/RHSA-2026:82354","https://access.redhat.com/errata/RHSA-2026:82372","https://access.redhat.com/errata/RHSA-2026:82857","https://access.redhat.com/security/cve/CVE-2025-14104","https://bugzilla.redhat.com/show_bug.cgi?id=2419369"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2025-14104","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2025-12-05T20:03:09.994553Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2025-12-05T20:03:19.733Z"}}],"cna":{"orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat","dateUpdated":"2026-10-14T19:31:48.792Z"}}},"related_cves":[{"value":"CVE-2025-14104","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":22958,"advisory_id":"80e19561-a2c7-494e-830f-07d3875092eb","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53612","source_published_at":"2026-10-14T14:47:25.523+00:00","published_at":"2026-10-25T06:10:33.179469+00:00","extraction_method":"structured","technologies":["core-cve","util-linux"],"cve_ids":["CVE-2026-53612"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"util-linux mount hook_owner TOCTOU allows local privilege escalation","summary":"util-linux is a random collection of Linux utilities. In util-linux 2.39 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility's `hook_owner.c` post-mount hook performs path-based `chmod()` and `lchown()` operations on a previously validated mount target. A local low-privileged user authorized by an `/etc/fstab` entry with `user` or `users` and an `X-mount.mode`, `X-mount.owner`, or `X-mount.group` option can use `renameat2(RENAME_EXCHANGE)` to race a writable ancestor of the target and redirect the privileged ownership or mode change to a root-owned path, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2.","evidence":"cve:CVE-2026-53612","products":[{"name":{"value":"util-linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-53612","aliases":["CVE-2026-53612"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7,"attackVector":"LOCAL","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"util-linux","product":"util-linux","versions":[{"status":"affected","version":">= 2.39, < 2.41.5"},{"status":"affected","version":">= 2.42, < 2.42.2"}]}],"modified":"2026-10-14T18:26:36.386Z","provider":"cve","references":["https://github.com/util-linux/util-linux/security/advisories/GHSA-g8wm-75wr-g2vh","https://github.com/util-linux/util-linux/commit/24da33905c7115c4cbccd0afb2a469804e96467a","https://github.com/util-linux/util-linux/commit/722c96974dd4009a334e4aee556eedaab5fb94b4","https://github.com/util-linux/util-linux/commit/897a08c2b11dfa66975c3d24d63c7bf5f5be1a7c","https://github.com/util-linux/util-linux/commit/d0c5adaeb3a3d823aba1377794de8f009b8152cc","https://github.com/util-linux/util-linux/releases/tag/v2.41.5","https://github.com/util-linux/util-linux/releases/tag/v2.42.2"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-53612","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-14T18:24:31.298549Z"}}}],"references":[{"url":"https://github.com/util-linux/util-linux/security/advisories/GHSA-g8wm-75wr-g2vh","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-14T18:26:36.386Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-14T14:47:25.523Z"}}},"related_cves":[{"value":"CVE-2026-53612","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":21796,"advisory_id":"8c1aafdb-ac58-4e9a-b430-2fd0567ed98f","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2022-0563","source_published_at":"2022-02-21T00:00:00+00:00","published_at":"2026-10-25T05:51:27.20891+00:00","extraction_method":"structured","technologies":["core-cve","util-linux"],"cve_ids":["CVE-2022-0563"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"CVE-2022-0563","summary":"A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an \"INPUTRC\" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.","evidence":"cve:CVE-2022-0563","products":[{"name":{"value":"util-linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2022-0563","aliases":["CVE-2022-0563"],"metrics":[],"affected":[{"vendor":"n/a","product":"util-linux","versions":[{"status":"affected","version":"util-linux 2.37.4"}]}],"modified":"2026-10-14T12:12:32.435Z","provider":"cve","references":["https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w%40ws.net.home/T/#u","https://security.netapp.com/advisory/ntap-20220331-0002/","https://security.gentoo.org/glsa/202401-08"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w%40ws.net.home/T/#u","tags":["x_transferred"]},{"url":"https://security.netapp.com/advisory/ntap-20220331-0002/","tags":["x_transferred"]},{"url":"https://security.gentoo.org/glsa/202401-08","name":"GLSA-202401-08","tags":["vendor-advisory","x_transferred"]}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-02T23:32:46.398Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.5,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"id":"CVE-2022-0563","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2024-01-18T00:54:32.653160Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2025-06-09T15:39:20.619Z"}},{"affected":[{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"}],"x_adpType":"supplier","references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html"}],"providerMetadata":{"orgId":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","shortName":"siemens-SADP","dateUpdated":"2026-10-14T12:12:32.435Z"}}],"cna":{"orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat","dateUpdated":"2024-01-07T09:06:24.336Z"}}},"related_cves":[{"value":"CVE-2022-0563","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null}}],"next_after":28955,"next_before":21796}