[ANNOUNCE] util-linux v2.41.4

Karel Zak <[email protected]> Wed, 1 Apr 2026 13:30:06 +0200

Newsgroups	org.kernel.vger.util-linux,org.kernel.vger.linux-fsdevel,org.kernel.vger.linux-kernel
Message-ID	<r6bqqytbylypey4kvj3fspb7l3o7im6dlamht5s6v2bfjs55b5@q666gfswirs6>

The util-linux release v2.41.4 is now available at

  http://www.kernel.org/pub/linux/utils/util-linux/v2.41

This is a security maintenance release addressing:

 CVE-2026-27456 - mount(8) TOCTOU symlink attack via loop device.
   The SUID mount follows symlinks when resolving loop backing file
   paths. On systems where non-root users are permitted to mount loop
   devices (via 'user' option in fstab), this allows access to
   arbitrary files.

 CWE-190 - Integer overflow in libblkid parse_dos_extended().
   A crafted MBR disk image can cause uint32_t wraparound in EBR
   chain processing, causing reported partitions to not match the
   on-disk layout. Tools like udisks may then register a partition
   at logical sector 0.

Feedback and bug reports, as always, are welcomed.

  Karel

-- 
 Karel Zak  <[email protected]>
 http://karelzak.blogspot.com