Vulnerability · Published Sep 2, 2026 · Assigned by redhat
CVE-2026-78409Util-linux: util-linux: x-mount.subdir detached-tree resolution can escape via intermediate symlinks
High 7.0
In plain English
A high-severity security flaw in Red Hat Enterprise Linux 10 from Red Hat. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.24 | util-linux | 2.42.3-r0 | ALPINE-CVE-2026-78409 |
| Debian:13 | util-linux | no fix listed | DEBIAN-CVE-2026-78409 |
| Debian:14 | util-linux | 2.42.3-1 | DEBIAN-CVE-2026-78409 |
| Ubuntu:22.04:LTS | util-linux | no fix listed | UBUNTU-CVE-2026-78409 |
| Ubuntu:24.04:LTS | util-linux | no fix listed | UBUNTU-CVE-2026-78409 |
| Ubuntu:26.04:LTS | util-linux | no fix listed | UBUNTU-CVE-2026-78409 |
| Ubuntu:26.10 | util-linux | no fix listed | UBUNTU-CVE-2026-78409 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat Hardened Images | see references |
| Red Hat | Red Hat Enterprise Linux 10 | see references |
| Red Hat | Red Hat Enterprise Linux 7 | see references |
| Red Hat | Red Hat Enterprise Linux 8 | see references |
| Red Hat | Red Hat Enterprise Linux 9 | see references |
| Red Hat | Red Hat Enterprise Linux 9 | see references |
| Red Hat | Red Hat Enterprise Linux 9 | see references |
| Red Hat | Red Hat OpenShift Container Platform 4 | see references |
| Red Hat | Red Hat OpenShift Container Platform 4 | see references |
| Red Hat | Red Hat OpenShift Container Platform 5 | see references |
Weakness: CWE-59 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- RHSA-2026:63162 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2026-78409 vdb-entry, x_refsource_REDHAT
- RHBZ#2522607 issue-tracking, x_refsource_REDHAT
- https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv