Changes between v2.41.5 and v2.41.6 -------------------------------------------- commit 02822c9374fc72d38baf8a1f859eb0813970bf3f Author: Karel Zak Date: Tue Sep 1 12:48:39 2026 +0200 docs: update v2.41.6-ReleaseNotes Signed-off-by: Karel Zak Documentation/releases/v2.41.6-ReleaseNotes | 5 +++++ 1 file changed, 5 insertions(+) commit 5a6ebcc542bfa96f5331ba087699a07f116fffc0 Author: Masatake YAMATO Date: Fri May 8 06:40:10 2026 +0900 tests: (lsfd/mkfds-udp*) make UDPLite related test cases skippable Signed-off-by: Masatake YAMATO (cherry picked from commit 98a242e556d9d68dcd4cdd3a1949878e016eddb7) (cherry picked from commit 4d23a9de701e50cdfc54fb98be47ed40175d4be3) tests/expected/lsfd/mkfds-udp | 12 --- tests/expected/lsfd/mkfds-udp-lite | 12 +++ tests/expected/lsfd/mkfds-udp6 | 12 --- tests/expected/lsfd/mkfds-udp6-lite | 12 +++ tests/ts/lsfd/mkfds-udp | 121 ++-------------------------- tests/ts/lsfd/mkfds-udp-lite | 30 +++++++ tests/ts/lsfd/mkfds-udp6 | 123 ++--------------------------- tests/ts/lsfd/mkfds-udp6-lite | 30 +++++++ tests/ts/lsfd/udp-common.bash | 152 ++++++++++++++++++++++++++++++++++++ 9 files changed, 246 insertions(+), 258 deletions(-) commit e04f9bc9e8f9c14c628c4d7ab8b8ca84f797a0c8 Author: Masatake YAMATO Date: Wed May 6 18:39:13 2026 +0900 tests: (lsfd/option-inet{,-udp}) make UDPLite related test case skippable Fixes #4311 Linux 7.1-rc1 has removed UDP Lite. In the test case lsfd/option-inet, UDP Lite was must. This change moves UDPLite related test parts to a new test case lsfd/option-inet-udp and makes lsfd/option-inet-udp skippable on the platform where UDPLite is not implemented. Signed-off-by: Masatake YAMATO (cherry picked from commit 512b756cd250081bb49ea0aba24e3dcc064231f8) (cherry picked from commit 33981ff8bd970b79f350d58ffd7878f0a638a929) tests/expected/lsfd/option-inet | 52 +++++++-------- tests/expected/lsfd/option-inet-udplite | 11 ++++ tests/ts/lsfd/option-inet | 24 +++---- tests/ts/lsfd/option-inet-udplite | 113 ++++++++++++++++++++++++++++++++ 4 files changed, 154 insertions(+), 46 deletions(-) commit a70eec072c79d5ed3837c7d6fa9953035f69adc8 Author: Karel Zak Date: Tue Sep 1 12:34:07 2026 +0200 tests: (lsfd) add a function checking the availability of UDPLite socket Signed-off-by: Masatake YAMATO (cherry picked from commit 8ba7a7761995336098055422e9ed380577a65c37) Signed-off-by: Karel Zak tests/helpers/test_mkfds.c | 4 ++-- tests/ts/lsfd/lsfd-functions.bash | 22 ++++++++++++++++++++++ 2 files changed, 24 insertions(+), 2 deletions(-) commit d4099300eb75ffce4534547f407a40a4de363e9b Author: Karel Zak Date: Tue Sep 1 12:09:51 2026 +0200 build-sys: update release dates Signed-off-by: Karel Zak NEWS | 2 +- configure.ac | 2 +- meson.build | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) commit 5215b515d2a3f39c05cfd9dbe550c0109a3dfef5 Author: Karel Zak Date: Tue Sep 1 12:05:46 2026 +0200 docs: update v2.41.6-ReleaseNotes Signed-off-by: Karel Zak Documentation/releases/v2.41.6-ReleaseNotes | 51 +++++++++++++++++++++++++++++ 1 file changed, 51 insertions(+) commit a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc Author: Karel Zak Date: Tue Jul 28 11:40:25 2026 +0200 libmount: skip post-mount hooks after failed mount helper [CVE-2026-76642] When an external mount. helper exits nonzero, exec_helper() stores the failure in helper_status but returns zero (meaning the fork/exec/wait infrastructure succeeded). This zero propagates as the mount result, causing MNT_STAGE_MOUNT_POST and MNT_STAGE_POST hooks to execute as if the mount had succeeded. This allows privileged post-mount operations on the pre-existing target filesystem: - X-mount.idmap clones and idmaps the underlying target, creating an overmount that inherits suid/exec from the root filesystem (ignoring nosuid/nodev/noexec from fstab) - X-mount.owner/group/mode changes the physical target inode ownership and permissions even though no mount was created Gate both MNT_STAGE_MOUNT_POST in mnt_context_do_mount() and MNT_STAGE_POST in mnt_context_mount() on is_success_status(), which already correctly distinguishes helper exit status from process execution status. This is a centralized fix -- individual hooks do not need their own guards. Audit of all hooks registered at these stages: MNT_STAGE_MOUNT_POST: - hook_mount.c (attach, propagation, vfsflags): already skip when helper executed (commit f94a7760) - hook_idmap.c: would clone+idmap pre-existing target -- now blocked - hook_subdir.c: deinit calls tmptgt_cleanup() -- safe - hook_mount_legacy.c (propagation, bindremount): no resources to leak - hook_loopdev.c: deinit fixed to call delete_loopdev() when the cleanup hook is skipped (was only free(), leaking fd and device) - hook_veritydev.c: deinit calls delete_veritydev() -- safe MNT_STAGE_POST: - hook_owner.c: would chown/chmod target -- now blocked; deinit only frees uid/gid/mode struct, no resources to leak Signed-off-by: Karel Zak (cherry picked from commit f57cea130839c0af8dc0525274267ae4cfd66bbf) (cherry picked from commit 1d14676ea70003e9f5b2a6a76af0cadb1190411a) libmount/src/context_mount.c | 23 ++++++++++++++++++++--- libmount/src/hook_loopdev.c | 13 +++++++++++-- 2 files changed, 31 insertions(+), 5 deletions(-) commit 9fcb98bf08d9119d07ba3a3c709b1a85e4a1bbcb Author: Karel Zak Date: Mon Jul 20 14:59:21 2026 +0200 libmount: pin source path with openat2() for restricted users [CVE-2026-78410] In restricted (non-root) mode, mnt_context_open_tree() resolves the source path via open_tree(AT_FDCWD, path, ...) which follows symlinks in intermediate path components. A local attacker who can replace the fstab-authorized bind source path or an ancestor with a symlink can redirect the privileged mount operation to an arbitrary directory. When combined with X-mount.owner/group/mode the post-mount hook applies root-privileged chown/chmod to the bind source inode, giving a local ownership/permission modification primitive on paths not authorized by fstab. Fix by using mnt_open_tree() with RESOLVE_NO_SYMLINKS in restricted mode. Also fix hook_idmap.c fallback open_tree() call to use the same pattern. Unrestricted (root) callers pass resolve=0 and get the direct open_tree() path. Signed-off-by: Karel Zak (cherry picked from commit fb8e2653553ce2ecd077a294d53a1422d7c6dbc0) (cherry picked from commit 9a8d0d60c55d3a55f89f6f75a17bae31bc5ee1c6) libmount/src/context.c | 4 +++- libmount/src/hook_idmap.c | 6 ++++-- 2 files changed, 7 insertions(+), 3 deletions(-) commit b21f4cee55f723b045920dad5ce48a659d34cac8 Author: Karel Zak Date: Thu Jul 9 16:10:08 2026 +0200 libmount: restrict source path canonicalization for non-root users [CVE-2026-78410] In restricted (suid, non-root) mode, mnt_context_prepare_srcpath() calls realpath() as euid=0 to canonicalize the source path. This follows symlinks through directories where the real user has write access (e.g. /home/user/), allowing redirection to arbitrary files. Only canonicalize /dev/ paths (e.g. /dev/cdrom -> /dev/sr0) and verify the result stays within /dev/. For non-/dev/ paths (e.g. disk images in user-writable directories), keep the original fstab path. Symlink protection for these paths is handled at open time by RESOLVE_NO_SYMLINKS in ul_open_no_symlinks(). This is a follow-up to commits: 5e390467b ("loopdev: add LOOPDEV_FL_NOFOLLOW to prevent symlink attacks") d07aad41e ("libmount: ignore X-mount.nocanonicalize for restricted users") Signed-off-by: Karel Zak (cherry picked from commit e554245ccc165fcdd4b8ba68bf2994ee14b98607) (cherry picked from commit 6051830a27a852fed92ebd8493e57aa3d5d9cf18) libmount/src/context.c | 17 ++++++++++++++++- sys-utils/mount.8.adoc | 12 +++++++++--- 2 files changed, 25 insertions(+), 4 deletions(-) commit 71ff1c94be2fd2577bf600accb5c6ad2782276ef Author: Karel Zak Date: Mon Jul 20 14:40:16 2026 +0200 libmount: add mnt_open_tree() helper for safe tree opening Add mnt_open_tree() that combines openat2() path pinning with open_tree() into a single call. When resolve flags are non-zero, the path is first pinned with ul_openat_resolve(), then cloned with open_tree(AT_EMPTY_PATH). When resolve is zero, open_tree() is called directly. This consolidates the openat2+open_tree pattern used for symlink protection in restricted mount operations. Signed-off-by: Karel Zak (cherry picked from commit 37afc15d9e5a0accea94eb067b151e21f8494880) (cherry picked from commit 90a1f3b5b134b775dd30a46155064731ba40c519) libmount/src/mountP.h | 2 ++ libmount/src/utils.c | 29 +++++++++++++++++++++++++++++ 2 files changed, 31 insertions(+) commit 4cccf4edc256507734e3484cfaedf5980945c2fa Author: Karel Zak Date: Mon Jul 20 14:36:16 2026 +0200 lib/fileutils: add ul_openat_resolve() openat2 wrapper Add ul_openat_resolve() as a generic openat2(2) wrapper with caller-specified resolve flags. No fallback to weaker alternatives -- returns -1/ENOSYS if openat2 is unavailable. Rewrite ul_open_no_symlinks() to use ul_openat_resolve() with RESOLVE_NO_SYMLINKS, dropping the unsafe O_NOFOLLOW fallback that only protected the final path component. Add fallback defines for RESOLVE_NO_SYMLINKS and RESOLVE_BENEATH in fileutils.h. Signed-off-by: Karel Zak (cherry picked from commit b9e07ce6f5ad54c38cf3ebc7100101e487be91bd) (cherry picked from commit 1426aa06ff2f6a21cba9102c35e3577641b356ff) include/fileutils.h | 9 +++++++++ lib/fileutils.c | 22 ++++++++++++++-------- 2 files changed, 23 insertions(+), 8 deletions(-) commit 43ec8a89f6c99130727084b3496a2ffd2b4200f0 Author: Karel Zak Date: Mon Aug 31 17:03:32 2026 +0200 nsenter, unshare: add O_CLOEXEC to all open() calls [CVE-2026-78408] Add O_CLOEXEC (and EFD_CLOEXEC for eventfd) as defense in depth to all file descriptor creation sites in nsenter and unshare. All these descriptors are already explicitly closed before exec, but O_CLOEXEC provides a safety net against future code changes that might accidentally introduce a leak path. No functional change. Signed-off-by: Karel Zak sys-utils/nsenter.c | 8 ++++---- sys-utils/unshare.c | 12 ++++++------ 2 files changed, 10 insertions(+), 10 deletions(-) commit 61b49b7160bbb6780279344574746617e7fb11a4 Author: Karel Zak Date: Mon Aug 24 16:37:28 2026 +0200 wall, write: sanitize hostname in banner header The CVE-2024-28085 fix sanitized only message bodies via fputs_careful(), but the banner headers in wall(1) and write(1) still interpolate the system hostname without sanitization. An unprivileged user can set a malicious hostname containing terminal escape sequences via a user namespace (unshare -Ur -u + sethostname(2)), and wall/write will deliver those sequences to the terminals of all logged-in users. Fix by routing the banner output through fputs_careful() which strips control characters. This is an additional fix for CVE-2024-28085 (CVSS 3.1 score: 3.3). A new CVE ID has not been assigned (yet). Reported-by: Skyler Ferrante Signed-off-by: Karel Zak (cherry picked from commit 9ce8f2b5aefa011ef5b0c34aa14df9bb9db02dab) (cherry picked from commit f358b098d47659837d85b66fb387201224b272a0) term-utils/wall.c | 3 ++- term-utils/write.c | 6 ++++-- 2 files changed, 6 insertions(+), 3 deletions(-) commit 2dacaf3eea391e3bbf48e7d3ecce02cafe045b6d Author: Karel Zak Date: Wed May 27 15:15:22 2026 +0200 loopdev: use openat2(RESOLVE_NO_SYMLINKS) for backing file Use ul_open_no_symlinks() instead of open(O_NOFOLLOW) when LOOPDEV_FL_NOFOLLOW is set. O_NOFOLLOW only rejects symlinks at the last path component, but TOCTOU attacks swap intermediate components. openat2(RESOLVE_NO_SYMLINKS) rejects symlinks at any component. Signed-off-by: Karel Zak (cherry picked from commit 119d23f1e3f55cf10e3c66dab80fc308c9f26456) lib/loopdev.c | 23 ++++++++++++++--------- 1 file changed, 14 insertions(+), 9 deletions(-)