The vulnerability is a TOCTOU race between target validation and the actual mount call. A low‑privileged user whose fstab entry uses the legacy mount path and whose target path contains an attacker‑writable directory can swap components of the path with renameat2(RENAME_EXCHANGE) just after validation but before the mount is performed. This allows the attacker to redirect a privileged mount operation to a root‑owned location, such as /etc/sudoers.d, and thereby gain root privileges. The weakness is a classic time‑of‑check to time‑of‑use flaw (CWE‑367).

The affected product is util‑linux from the util‑linux project. Versions 2.17 through 2.41.6 and 2.42 through 2.42.3 are vulnerable when the legacy mount(2) path is used without /proc. The 2.42.4 release is affected for the legacy fallback without /proc and is only partially fixed by pinning legacy targets via /proc/self/fd. The new mount API in 2.41.5 and 2.42.2 includes target pinning, while 2.42.4 pins legacy targets through /proc/self/fd.

The CVSS score is 7, indicating a high severity impact. EPSS data shows a very low exploitation probability (< 1%). The vulnerability is not listed in the CISA KEV catalog, suggesting no widespread, documented exploitation as of the last update. An attacker who can modify fstab entries or create writable directories would be able to trigger the race and consequently achieve root privileges. The attack requires local user access and configuration changes in fstab, so the vector is limited to systems where such entries exist.