The util‑linux utility has a flaw where a restricted bind mount takes its source path from /etc/fstab but fails to pin that source before performing the privileged mount. A local user who can replace the authorized source or a writable ancestor in the filesystem hierarchy can redirect the mount to an arbitrary host directory. If the fstab entry also sets X‑mount.owner, X‑mount.group, or X‑mount.mode, the privileged mount subsequently changes ownership or permissions on the redirected inode, effectively granting the attacker privileged access to those files or directories.

Red Hat Enterprise Linux 7, 8, 9, and 10; Red Hat Hardened Images; Red Hat OpenShift Container Platform 4 – any system running util‑linux versions earlier than 2.41.6 or 2.42.3 is vulnerable because those releases contain the unpinned source issue.

The vulnerability carries a CVSS score of 7.8, indicating high severity. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog. Exploitation requires local access; the attacker must be able to modify the bind source or a writable ancestor chain. Because the mount command is privileged, the attacker can achieve privilege escalation without any additional network-level access.