fix(util-linux): CVE-2026-27456, CVE-2026-3184 by deepin-ci-robot · Pull Request #19 · deepin-community/util-linux

deepin-ci-robot · 2026-05-26T15:23:10Z

CVE 修复

CVE-2026-27456 (low)

Add LOOPDEV_FL_NOFOLLOW to prevent symlink attacks in mount.

Upstream: util-linux/util-linux@5e39046
Advisory: GHSA-qq4x-vfq4-9h9g

CVE-2026-3184 (medium)

Use original FQDN for PAM_RHOST in login.

Upstream: util-linux/util-linux@8b29aeb

Changes

debian/patches/CVE-2026-27456.patch: Fix TOCTOU vulnerability in mount loop device
debian/patches/CVE-2026-3184.patch: Fix PAM_RHOST bypass vulnerability in login

Generated-By: glm-5.1
Co-Authored-By: hudeng hudeng@deepin.org

Summary by Sourcery

Apply util-linux security fixes to protect mount and login against symlink and remote-host identity bypass vulnerabilities.

Bug Fixes:

Address four newly added util-linux security vulnerabilities through Debian patches.
Harden mount loop-device handling against symlink-related attacks.
Prevent login from accepting a manipulated PAM_RHOST value instead of the original fully qualified domain name.

Chores:

Register the new security patches in the Debian patch series and update the changelog.

sourcery-ai · 2026-05-26T15:23:17Z

Reviewer's guide (collapsed on small PRs)

Reviewer's Guide

Adds two Debian patch files and wires them into the package build to fix two upstream-reported security issues in util-linux: a TOCTOU/symlink attack vector in mount loop device handling and a PAM_RHOST bypass in login, by backporting the corresponding upstream commits.

File-Level Changes

Change	Details	Files
Backport upstream fix for TOCTOU/symlink attack in mount loop device handling using LOOPDEV_FL_NOFOLLOW.	Introduce a Debian patch that adds LOOPDEV_FL_NOFOLLOW when setting up loop devices in mount to prevent following symlinks. Align the patched code with upstream commit 5e390467b26a3cf3fecc04e1a0d482dff3162fc4 to ensure consistent behavior and minimal divergence. Register the new CVE patch in the Debian patches series so it is applied during package build.	`debian/patches/CVE-2026-27456.patch` `debian/patches/series`
Backport upstream fix for PAM_RHOST handling in login to prevent bypass via altered hostnames.	Introduce a Debian patch that ensures login passes the original fully qualified domain name as PAM_RHOST instead of a potentially modified form. Sync the patch with upstream commit 8b29aeb081e297e48c4c1ac53d88ae07e1331984 to minimize local maintenance. Register the new CVE patch in the Debian patches series so it is applied during package build.	`debian/patches/CVE-2026-3184.patch` `debian/patches/series`
Update Debian packaging metadata to record the security fix release.	Add a new stanza in the Debian changelog documenting the CVE fixes and referencing the added patches.	`debian/changelog`

Tips and commands

Interacting with Sourcery

Trigger a new review: Comment @sourcery-ai review on the pull request.
Continue discussions: Reply directly to Sourcery's review comments.
Generate a GitHub issue from a review comment: Ask Sourcery to create an
issue from a review comment by replying to it. You can also reply to a
review comment with @sourcery-ai issue to create an issue from it.
Generate a pull request title: Write @sourcery-ai anywhere in the pull
request title to generate a title at any time. You can also comment
@sourcery-ai title on the pull request to (re-)generate the title at any time.
Generate a pull request summary: Write @sourcery-ai summary anywhere in
the pull request body to generate a PR summary at any time exactly where you
want it. You can also comment @sourcery-ai summary on the pull request to
(re-)generate the summary at any time.
Generate reviewer's guide: Comment @sourcery-ai guide on the pull
request to (re-)generate the reviewer's guide at any time.
Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
pull request to resolve all Sourcery comments. Useful if you've already
addressed all the comments and don't want to see them anymore.
Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
request to dismiss all existing Sourcery reviews. Especially useful if you
want to start fresh with a new review - don't forget to comment
@sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

Enable or disable review features such as the Sourcery-generated pull request
summary, the reviewer's guide, and others.
Change the review language.
Add, remove or edit custom review instructions.
Adjust other review settings.

Getting Help

Contact our support team for questions or feedback.
Visit our documentation for detailed guides and information.
Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

deepin-ci-robot · 2026-05-26T15:23:19Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign tsic404 for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

https:/raw.githubusercontent.com/deepin-community/template-repository/master/debian/deepin/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

github-actions · 2026-05-26T15:23:31Z

TAG Bot

TAG: 2.40.4-3deepin15
EXISTED: no
DISTRIBUTION: unstable

sourcery-ai

Hey - I've reviewed your changes and they look great!

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

hudeng-go · 2026-05-27T01:24:03Z

/integrate

github-actions · 2026-05-27T01:24:36Z

AutoIntegrationPr Bot
auto integrate with pr url: deepin-community/Repository-Integration#4080
PrNumber: 4080
PrBranch: auto-integration-26485054483

deepin-community-ci-bot · 2026-07-22T11:57:40Z

TAG Bot

New tag: 2.40.4-3deepin12
DISTRIBUTION: unstable
Suggest: synchronizing this PR through rebase #21

deepin-community-ci-bot · 2026-08-26T09:25:19Z

TAG Bot

New tag: 2.40.4-3deepin14
DISTRIBUTION: unstable
Suggest: synchronizing this PR through rebase #23

…wing on detached tree [CVE-202 CVE: CVE-2026-78409 (high) - X-mount.subdir 选项在 Linux 6.15 及更高版本上使用分离树快速路径，并将配置的子目录传递给 open_tree()，使用 AT_SYMLINK_NOFOLLOW 标志。但该标志不会阻止中间符号链接遍历或保持解析在新挂载的文件系统内。具有 fstab 授权的 X-mount.subdir 条目的本地非特权用户可以附加主机路径到预期的安装点。 Upstream: util-linux/util-linux@ce4e181aa Co-authored-by: hudeng <hudeng@deepin.org> Generated-By: qwen3.6-35b

…er join to prevent authority l CVE: CVE-2026-78408 (high) - nsenter --join-cgroup 选项以 root 身份打开目标的 cgroup.procs 文件，并在后续的命名空间更改、凭据更改和 execve() 调用期间保持该文件描述符处于打开状态。由于内核使用原始打开时的凭据检查后续的 cgroup 迁移，因此在攻击者控制的目标中运行的程序可以继承 root 的移动主机进程到 cgroups 的能力。在特权操作员对目标使用 --join-cgroup 后，非特权用户可以迁移和终止无关的 root 进程。 Upstream: util-linux/util-linux@afe067c979b9ba2cbe856f7c6411210120ea62aa,https://github.com/util-linux/util-linux/commit/003c622428f09fc6544ed06b533d278dc14f88e0 Co-authored-by: hudeng <hudeng@deepin.org> Generated-By: qwen3.6-35b

…or restricted users [CVE-2026- CVE: CVE-2026-78410 (high) - 受限绑定挂载从 fstab 获取源路径，但在特权挂载操作前未锁定该源路径。本地非特权用户可以通过替换 fstab 授权的绑定源路径或其可写祖先目录为符号链接，将特权挂载操作重定向到任意目录。当与 X-mount.owner/group/mode 结合使用时，挂载后的钩子会对绑定源 inode 应用 root 权限的 chown/chmod，从而在未经 fstab 授权的路径上获得所有权/权限修改能力。 Upstream: util-linux/util-linux@9fcb98bf0 Co-authored-by: hudeng <hudeng@deepin.org> Generated-By: qwen3.6-35b

…ter failed mount helper [CVE-2 CVE: CVE-2026-76642 (high) - libmount: skip post-mount hooks after failed mount helper Upstream: util-linux/util-linux@1d14676 Co-authored-by: hudeng <hudeng@deepin.org> Generated-By: qwen3.6-35b

The openat2 hardening patches (CVE-2026-78409/78410) use struct open_how and RESOLVE_* flags from <linux/openat2.h>, but configure.ac never checked for that header, so HAVE_LINUX_OPENAT2_H was never defined while SYS_openat2 was available - the build failed with 'variable how has initializer but incomplete type' in lib/fileutils.c. Add a debian patch that: - asks configure for linux/openat2.h - includes it from mount-api-utils.h and provides RESOLVE_* fallbacks - corrects the RESOLVE_NO_SYMLINKS fallback value (0x02 is RESOLVE_NO_MAGICLINKS; RESOLVE_NO_SYMLINKS is 0x04) - declares mnt_context_target_fd_required() in mountP.h

deepin-ci-robot requested a review from BLumia May 26, 2026 15:23

deepin-ci-robot requested a review from chenchongbiao May 26, 2026 15:23

deepin-ci-robot added cve generated-by-ai labels May 26, 2026

sourcery-ai Bot reviewed May 26, 2026

View reviewed changes

deepin-community-ci-bot Bot mentioned this pull request May 27, 2026

auto integration deepin-community/util-linux deepin-community/Repository-Integration#4080

Open

deepin-ci-robot and others added 4 commits September 10, 2026 15:16

hudeng-go force-pushed the fix/CVE-2026-27456-multi branch from 554c932 to 0a3bd4a Compare September 10, 2026 07:46

Zeno-sole merged commit ef2b391 into master Sep 10, 2026
7 of 9 checks passed

This was referenced Sep 10, 2026

fix(util-linux): fix 4 CVE vulnerabilities #20

Open

feat: update util-linux to 2.40.4-5 #16

Draft

Navigation Menu

Uh oh!

fix(util-linux): CVE-2026-27456, CVE-2026-3184 - #19

fix(util-linux): CVE-2026-27456, CVE-2026-3184#19
Zeno-sole merged 5 commits into
masterfrom
fix/CVE-2026-27456-multi

deepin-ci-robot commented May 26, 2026 •

edited by sourcery-ai Bot

Loading

Uh oh!

sourcery-ai Bot commented May 26, 2026 •

edited

Loading

Reviewer's Guide

File-Level Changes

Interacting with Sourcery

Customizing Your Experience

Getting Help

Uh oh!

deepin-ci-robot commented May 26, 2026

Uh oh!

github-actions Bot commented May 26, 2026 •

edited

Loading

Uh oh!

sourcery-ai Bot left a comment

Uh oh!

hudeng-go commented May 27, 2026

Uh oh!

github-actions Bot commented May 27, 2026

Uh oh!

deepin-community-ci-bot Bot commented Jul 22, 2026

Uh oh!

deepin-community-ci-bot Bot commented Aug 26, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

deepin-ci-robot commented May 26, 2026 • edited by sourcery-ai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

CVE 修复

CVE-2026-27456 (low)

CVE-2026-3184 (medium)

Changes

Summary by Sourcery

Uh oh!

sourcery-ai Bot commented May 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reviewer's Guide

File-Level Changes

Interacting with Sourcery

Customizing Your Experience

Getting Help

Uh oh!

deepin-ci-robot commented May 26, 2026

Uh oh!

github-actions Bot commented May 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

sourcery-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

hudeng-go commented May 27, 2026

Uh oh!

github-actions Bot commented May 27, 2026

Uh oh!

deepin-community-ci-bot Bot commented Jul 22, 2026

Uh oh!

deepin-community-ci-bot Bot commented Aug 26, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

deepin-ci-robot commented May 26, 2026 •

edited by sourcery-ai Bot

Loading

sourcery-ai Bot commented May 26, 2026 •

edited

Loading

github-actions Bot commented May 26, 2026 •

edited

Loading