Detections
Analytics
Linux Distros Unpatched Vulnerability : CVE-2026-27456
medium Nessus Plugin ID 304773
Language:
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.- util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check- Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4. (CVE-2026-27456)
Note that Nessus relies on the presence of the package as reported by the vendor.
Solution
There is no known solution at this time.See Also
https://access.redhat.com/security/cve/cve-2026-27456
Plugin Details
Severity: Medium
ID: 304773
File Name: unpatched_CVE_2026_27456.nasl
Version: 1.6
Type: Local
Agent: unix
Family: Misc.
Published: 4/3/2026
Updated: 4/23/2026
Supported Sensors: Agentless Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Frictionless Assessment Azure, Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 5.1
CVSS v2
Risk Factor: Medium
Base Score: 6.9
Temporal Score: 6.2
Vector: CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C
CVSS Score Source: CVE-2026-27456
CVSS v3
Risk Factor: Medium
Base Score: 4.7
Temporal Score: 4.5
Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Temporal Vector: CVSS:3.0/E:P/RL:U/RC:C
Vulnerability Information
CPE: p-cpe:/a:redhat:enterprise_linux:util-linux-user, cpe:/o:debian:debian_linux:11.0, p-cpe:/a:centos:centos:libblkid, cpe:/o:canonical:ubuntu_linux:20.04:-:lts, p-cpe:/a:redhat:enterprise_linux:libfdisk-devel, cpe:/o:canonical:ubuntu_linux:24.04:-:lts, p-cpe:/a:redhat:enterprise_linux:libmount, p-cpe:/a:centos:centos:libsmartcols-devel, p-cpe:/a:centos:centos:util-linux-user, cpe:/o:debian:debian_linux:12.0, p-cpe:/a:centos:centos:python3-libmount, cpe:/o:canonical:ubuntu_linux:25.10, p-cpe:/a:redhat:enterprise_linux:libuuid, cpe:/o:redhat:enterprise_linux:9, cpe:/o:canonical:ubuntu_linux:18.04:-:lts, p-cpe:/a:centos:centos:uuidd, cpe:/o:centos:centos:8, p-cpe:/a:canonical:ubuntu_linux:util-linux, p-cpe:/a:redhat:enterprise_linux:libfdisk, p-cpe:/a:redhat:enterprise_linux:libblkid, p-cpe:/a:redhat:enterprise_linux:python3-libmount, p-cpe:/a:debian:debian_linux:util-linux, cpe:/o:redhat:enterprise_linux:8, cpe:/o:redhat:enterprise_linux:10, cpe:/o:debian:debian_linux:13.0, cpe:/o:canonical:ubuntu_linux:14.04:-:lts, p-cpe:/a:redhat:enterprise_linux:util-linux, p-cpe:/a:redhat:enterprise_linux:libmount-devel, p-cpe:/a:redhat:enterprise_linux:libsmartcols-devel, p-cpe:/a:redhat:enterprise_linux:libuuid-devel, p-cpe:/a:centos:centos:libmount-devel, p-cpe:/a:centos:centos:util-linux, p-cpe:/a:centos:centos:libuuid-devel, p-cpe:/a:centos:centos:libfdisk-devel, p-cpe:/a:redhat:enterprise_linux:util-linux-core, cpe:/o:canonical:ubuntu_linux:16.04:-:lts, p-cpe:/a:centos:centos:util-linux-core, p-cpe:/a:redhat:enterprise_linux:libsmartcols, p-cpe:/a:redhat:enterprise_linux:libblkid-devel, p-cpe:/a:centos:centos:libfdisk, cpe:/o:canonical:ubuntu_linux:22.04:-:lts, p-cpe:/a:centos:centos:libuuid, p-cpe:/a:centos:centos:libmount, p-cpe:/a:redhat:enterprise_linux:uuidd, p-cpe:/a:centos:centos:libsmartcols, p-cpe:/a:centos:centos:libblkid-devel
Required KB Items: Host/cpu, Host/local_checks_enabled, global_settings/vendor_unpatched, Host/OS/identifier
Exploit Available: true
Exploit Ease: Exploits are available
Reference Information
CVE: CVE-2026-27456