The flaw involves a time‑of‑check to time‑of‑use race in the SUID mount utility’s post‑mount hook. The hook performs path‑based chmod() and lchown() on a previously validated mount target. A low‑privileged local user who has a user or users entry in /etc/fstab and the X‑mount.mode, X‑mount.owner, or X‑mount.group options can invoke renameat2(RENAME_EXCHANGE) to swap a writable ancestor of that target, causing the later chmod or lchown to apply to a root‑owned path. As a result, the attacker can set arbitrary ownership or permissions on a root‑owned file or directory, effectively gaining root privileges. This classic TOCTOU vulnerability is identified as CWE‑367.

Application versions impacted are util‑linux 2.39 through 2.41.4 and 2.42 through 2.42.1. The issue is present in all builds of these releases and is fixed in util‑linux 2.41.5 and 2.42.2.

The CVSS score of 7 indicates a high severity vulnerability. The EPSS score of <1% suggests a low but nonzero probability of exploitation, and the vulnerability is listed as not in CISA KEV, implying no known widespread exploitation. Nevertheless, because the attacker only needs local authorization to use privileged fstab entries, the risk remains significant.