CVE-2026-88838: Busybox: busybox: non-root mount option filter bypass allows clearing fstab security restrictions

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-13 · updated 2026-10-15
Weakness: CWE-693

Description

A flaw was found in BusyBox's mount utility. A non-root user can bypass mount security restrictions set in /etc/fstab by specifying clearing-mask options on the command line. These options pass the non-root flag filter and are merged with fstab options as strings; when the combined options are re-parsed, clearing options can override nosuid, nodev, and noexec protections the administrator intended to enforce.

Affected products

Red Hat Hardened Images: all versions

References

https://access.redhat.com/security/cve/CVE-2026-88838
https://bugzilla.redhat.com/show_bug.cgi?id=2531352

Get alerted when CVE-2026-88838 or the next vulnerability affects your stack