In util-linux versions 2.39.1 through 2.41.4 and 2.42 through 2.42.1, the set‑uid mount utility reads the LIBMOUNT_FORCE_MOUNT2 environment variable without validation, allowing a local low‑privileged user to force a non‑atomic bind‑mount path. If an /etc/fstab entry is authorized for the user or users and protected by nosuid, noexec, or nodev, the attacker can race the initial non‑protected bind mount against the subsequent remount that applies the security flags, temporarily exposing a SUID program. Executing the program from the briefly unprotected mount can grant root privileges. The weakness is grounded in improper authorization (CWE‑269) and a race condition (CWE‑807).

The vulnerability affects the util‑linux package, specifically util‑linux 2.39.1, 2.39.2, through 2.41.4, and util‑linux 2.42 and 2.42.1. Versions 2.41.5 and 2.42.2 and later contain the fix that removes the unsafe environment variable handling.

The CVSS score of 7 indicates high severity for this local privilege escalation. The EPSS score is below 1%, and the vulnerability is not listed in the CISA KEV catalog. Attack requires local access, the ability to set the LIBMOUNT_FORCE_MOUNT2 variable, and a successful race condition; once achieved, the attacker can elevate to root. Although exploitation probability is low, the potential impact justifies treating it as a high risk for any system that permits user bind mounts.