CVE-2026-78409
Received Received - Intake

X-mount.subdir Symlink Traversal in Linux Kernel

Publication date: 2026-09-02

Last updated on: 2026-09-02

Assigner: redhat-SADP

Description
The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-02
Last Modified
2026-09-02
Generated
2026-09-02
AI Q&A
2026-09-02
EPSS Evaluated
N/A
NVD
CVE-2026-78409
EUVD
EUVD-2026-70107

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
util-linux util-linux From 2.42 (inc) to 2.42.3 (exc)
util-linux util-linux 2.41.6
util-linux util-linux 2.42.3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-59 The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-78409 is a vulnerability in the util-linux package affecting versions 2.42 and later. It involves the X-mount.subdir feature, which allows restricted users to mount a subdirectory of a filesystem. Due to improper path resolution, attackers can exploit intermediate symlinks or procfs paths to escape the intended subdirectory and access arbitrary host paths, such as /etc/passwd.

Detection Guidance

Check util-linux version with 'mount --version' or 'rpm -q util-linux'. Inspect /etc/fstab for X-mount.subdir entries. Look for symlinks in mount paths or unexpected mounts using 'mount' or 'findmnt'. Check kernel version with 'uname -r' for >= 6.15.

Impact Analysis

An unprivileged user with an authorized X-mount.subdir entry in /etc/fstab can exploit this to mount a host path at the intended mountpoint. This may allow traversal of filesystems, reading or modifying unexpected files, or bypassing security mechanisms. Systems using SUID-root /usr/bin/mount with X-mount.subdir are particularly at risk.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive files, violating data confidentiality and integrity requirements under GDPR and HIPAA. Unauthorized file access may result in data breaches, non-compliance with privacy regulations, and potential legal consequences.

Mitigation Strategies

Upgrade util-linux to v2.41.6, v2.42.3, or later. Remove or disable X-mount.subdir entries in /etc/fstab. Temporarily restrict SUID permissions on /usr/bin/mount if possible. Monitor for unauthorized mounts or symlink exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-78409. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart