What’s Vulnerable › Vulnerabilities

CVE-2026-78409: Util-linux: util-linux: x-mount.subdir detached-tree resolution can escape via intermediate symlinks

• Severity: high (CVSS 7.0 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-02 · updated 2026-10-21
• Weakness: CWE-59

Description

The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.

Affected products

• Red Hat Hardened Images: all versions — fixed in 2.42.2-3.4.hum1

How to fix

Upgrade to a fixed version: Red Hat Hardened Images 2.42.2-3.4.hum1. Check the vendor advisory for mitigations.

References

• https://access.redhat.com/errata/RHSA-2026:63162
• https://access.redhat.com/security/cve/CVE-2026-78409
• https://bugzilla.redhat.com/show_bug.cgi?id=2522607
• https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv
• https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv

Get alerted when CVE-2026-78409 or the next vulnerability affects your stack