{"id":"CVE-2026-78409","title":"Util-linux: util-linux: x-mount.subdir detached-tree resolution can escape via intermediate symlinks","summary":"The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution in…","severity":"high","cvss":7,"cvssVector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-59"],"vendor":"Red Hat","product":"util-linux-main","affected":["util-linux-main (all versions)","util-linux","util-linux","util-linux","rhel8/flatpak-runtime","rhel8/flatpak-sdk","util-linux","openshift/ose-rhel-coreos-8","openshift/ose-rhel-coreos-9"],"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"total","timestamp":"2026-09-02T15:29:06.011028Z"},"exploitAvailable":true,"published":"2026-09-02","updated":"2026-10-21","sourceUpdated":"2026-10-21T17:51:49.053Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-78409","references":[{"url":"https://access.redhat.com/errata/RHSA-2026:63162","label":"RHSA-2026:63162"},{"url":"https://access.redhat.com/security/cve/CVE-2026-78409"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2522607","label":"RHBZ#2522607"},{"url":"https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv"}],"tags":["cve.org","exploit-available"],"epss":0.00154,"epssPercentile":0.0417,"ingestedAt":"2026-10-21T18:09:27.273Z","slug":"CVE-2026-78409","body":"## Overview\n\nThe X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.\n\n## Affected\n\n- `util-linux-main (all versions)`\n- `util-linux`\n- `util-linux`\n- `util-linux`\n- `rhel8/flatpak-runtime`\n- `rhel8/flatpak-sdk`\n- `util-linux`\n- `openshift/ose-rhel-coreos-8`\n- `openshift/ose-rhel-coreos-9`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n### Workarounds\n\nUpgrade to util-linux v2.41.6, v2.42.3, or later. Until a fix is applied, do not allow unprivileged /etc/fstab entries that specify X-mount.subdir.","depth":"midnight","depthScore":51,"depthScoreParts":{"impact":38.5,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[]}