CVE-2026-78409
The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.
Scoring
- Severity
- HIGH
- CVSS base score
- 7
- CVSS vector
- CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS probability
- 0.12%
- CWE
- CWE-59
- Published
- 2026-09-02
- Last modified
- 2026-09-03
Affected products
- Red Hat Red Hat Hardened Images
Weakness type
Related vulnerabilities
- CVE-2026-88265 — Crun: crun: /dev/null symlink follow during stdio reopen allows host bind-mount write and chown
- CVE-2026-88264 — Crun: crun: /dev/console symlink follow allows root-owned file creation outside the rootfs
- CVE-2026-87766 — Bubblewrap: bubblewrap: symlink traversal via /oldroot allows writing files outside sandbox during setup
- CVE-2026-78622 — Improper Link Resolution in Okta Verify for Windows Uninstaller Data Removal
- CVE-2026-81963 — Windows Update Stack Elevation of Privilege Vulnerability
- CVE-2026-69425 — Windows NTFS Tampering Vulnerability
- CVE-2026-69289 — Windows Setup Files Cleanup Elevation of Privilege Vulnerability
- CVE-2026-83999 — Windows Resilient File System (ReFS) Deduplication Service Elevation of Privilege Vulnerability