CVE-2026-78409 in Red Hat
Summary
by MITRE • 09/02/2026
The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/02/2026
The vulnerability centers on a flaw in how Linux kernel versions 6.15 and later handle the xmount subsystem, specifically regarding the subdir option which is designed to restrict access within a mounted filesystem tree. The implementation utilizes a detached-tree fast path optimization that invokes the open_tree system call with the AT_SYMLINK_NOFOLLOW flag. While this flag is intended to prevent symlink resolution from following symbolic links outside of the target context, it fails to adequately constrain intermediate directory traversal or enforce boundaries strictly within the newly mounted filesystem namespace. This oversight allows for a bypass of the intended isolation mechanisms that are critical for maintaining security in containerized environments and chroot-like setups where strict path confinement is required.
From a technical perspective, the core issue lies in the interpretation of AT_SYMLINK_NOFOLLOW during the tree attachment process. The flag prevents following symlinks at the final component but does not inherently block traversal through intermediate directories that may contain symbolic links leading outside the intended mount point. Consequently, an attacker can construct a path where intermediate components resolve to locations beyond the restricted subtree. This behavior contradicts the security model expected by users relying on xmount.subdir for containment, as it permits escaping the designated directory structure and accessing host-level paths that should remain inaccessible under normal operational constraints.
The operational impact of this vulnerability is significant for environments utilizing unprivileged user mounts with specific fstab configurations. A local unprivileged user who possesses an authorized entry in /etc/fstab allowing them to mount a filesystem using the xmount.subdir option can exploit this flaw to attach arbitrary host paths at their intended mountpoint. This effectively breaks the isolation boundary, granting the attacker read and potentially write access to sensitive system files or data belonging to other users or services running on the same host. In containerized deployments where such mounts are used for volume sharing, this could lead to privilege escalation if combined with other vulnerabilities or misconfigurations that allow execution of code within the mounted context.
This flaw aligns with CWE-20 Improper Input Validation and CWE-787 Out-of-bounds Write in terms of boundary enforcement failures, as it represents a failure to properly validate path components against security boundaries. In the MITRE ATT&CK framework, this behavior facilitates lateral movement or privilege escalation by allowing an unprivileged user to access resources outside their assigned sandbox, which can be categorized under techniques related to Accessing Remote Resources or Exploitation for Credential Access depending on the specific data targeted. The lack of strict containment undermines the principle of least privilege enforced by mount namespaces and chroot-like restrictions.
Mitigation strategies should focus on ensuring that path resolution strictly adheres to the intended boundary without relying solely on AT_SYMLINK_NOFOLLOW for intermediate components. Kernel developers must review the detached-tree fast path logic to ensure that all symlink traversals, whether at final or intermediate stages, are validated against the root of the mounted subtree. Until a patch is available, administrators should restrict fstab entries granting mount privileges to trusted users only and audit existing configurations for any use of xmount.subdir with unprivileged accounts. Additionally, employing additional security layers such as AppArmor or SELinux policies can help enforce stricter path access controls that complement kernel-level restrictions, providing defense in depth against this type of boundary bypass.