The vulnerability is a Time‑of‑Check/Time‑of‑Use race condition in the SUID mount binary (usr/bin/mount) shipped with util‑linux. During the setup of loop devices the binary validates the source file path as an unprivileged user by forking and calling setuid(), then calls realpath to resolve the path. However, it later re‑canonicalizes the same path and opens the file with root privileges (effective UID zero) without verifying that the path remained unchanged between the two operations. This missing check allows a local user to replace the original file with a symlink pointing to any root‑owned file or device while the race window exists, causing mount to read or mount that file as root. The result is unauthorized access to root‑protected files, block devices, backup images, or any file containing a valid filesystem.

The issue affects the util‑linux package on Linux distributions that ship a SUID mount binary. All versions prior to 2.41.4 are vulnerable, as the bug was fixed in that release. Targeted configurations include systems that permit the loop option in /etc/fstab and provide a directory writable by the unprivileged user. On virtually all Linux distributions the SUID bit on /usr/bin/mount is set by default, so the vulnerability is present when the default configuration is used.

The CVSS score of 4.7 denotes a moderate severity, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires local access: the attacker must be able to write into a directory referenced by a user,loop /etc/fstab entry, and the mount binary must retain its SUID bit. Once the race condition succeeds, the attacker can read any root‑owned file or device via the loop mount, effectively elevating privileges locally. Because the attack vector is local and depends on specific fstab entries, the risk is limited to systems that use loop mounts with user options, but the impact on confidentiality is significant.