CVE-2026-88838
Description
A flaw was found in BusyBox's mount utility. A non-root user can bypass mount security restrictions set in /etc/fstab by specifying clearing-mask options on the command line. These options pass the non-root flag filter and are merged with fstab options as strings; when the combined options are re-parsed, clearing options can override nosuid, nodev, and noexec protections the administrator intended to enforce.
Statement
Exploitation requires BusyBox mount installed setuid root, FEATURE_MOUNT_FSTAB/user-mountable fstab entries, and attacker-controlled filesystem content for follow-on abuse (for example setuid binaries on removable media). Fedora ships BusyBox without setuid mount by default. Red Hat Hardened Images and embedded-style deployments should be assessed per image configuration. util-linux mount uses separate non-root validation.
Mitigation
Do not install BusyBox mount setuid root where user-mountable fstab entries use nosuid, nodev, or noexec. Remove user/users from sensitive fstab lines, or use util-linux mount.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | 5.5 |
| Attack Vector | Local | N/A | Local |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | High | N/A | High |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
cve.org: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Red Hat CVSS v3 Score Explanation
Raised after dispute verification (2026-10-13): cmdopt string merge + re-parse clears fstab nosuid/nodev/noexec despite non-root filter; local integrity impact on user mounts.
Understanding the Weakness (CWE)
Access Control
Technical Impact: Bypass Protection Mechanism
Acknowledgements
Red Hat would like to thank Shubham Raj (Causal Security) for reporting this issue.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
