CVE-2026-78409High· 7.0▾ MidnightPoC availableThe X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution in…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 38.5 · likelihood 0 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.2%
The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.
util-linux-main (all versions)util-linuxutil-linuxutil-linuxrhel8/flatpak-runtimerhel8/flatpak-sdkutil-linuxopenshift/ose-rhel-coreos-8openshift/ose-rhel-coreos-9Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Upgrade to util-linux v2.41.6, v2.42.3, or later. Until a fix is applied, do not allow unprivileged /etc/fstab entries that specify X-mount.subdir.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-78410High· 7.8Util-linux: util-linux: restricted bind mounts do not pin the source, allowing x-mount.owner/group/mode redirection
CVE-2026-78408High· 7.9The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve()
CVE-2024-1753High· 8.6A flaw was found in Buildah (and subsequently Podman Build) which allows containers to mount arbitrary locations on the host filesystem into build containers
CVE-2026-108119Medium· 6.3A flaw was found in busybox
CVE-2026-92822Medium· 6.2Libmodulemd: libmodulemd: unbounded recursion when parsing nested xmd yaml
CVE-2026-112915Medium· 5.5filelock: filelock: Denial of Service via crafted SQLite lock database (CVE-2026-112915)