Every CVE Search/ Get API key

CVE-2026-78409

Util-linux: util-linux: x-mount.subdir detached-tree resolution can escape via intermediate symlinks

7.0 HighFix available

The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
High
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.19%Up 0.1 points since Sep 3, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.0

Util-linux: util-linux: x-mount.subdir detached-tree resolution can escape via intermediate symlinks

The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.

Record
CVE-2026-78409
CVSS 3.1
7.0 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-59
Updated
2026-11-02
EUVDEUVD-2026-70107 7.0

The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.

Record
EUVD-2026-70107
CVSS 3.1
7.0 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
NVD 7.0

The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.

Record
CVE-2026-78409
CVSS 3.1
7.0 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-59
Updated
2026-11-05
OSVALPINE-CVE-2026-78409 7.0

The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.

Record
ALPINE-CVE-2026-78409
CVSS 3.1
7.0 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVBELL-CVE-2026-78409 7.0
Record
BELL-CVE-2026-78409
CVSS 3.1
7.0 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2026-78409 7.0

The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.

Record
DEBIAN-CVE-2026-78409
CVSS 3.1
7.0 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-05
Show 6 moreShow less
OSVRHSA-2026:63162 7.9

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record
RHSA-2026:63162
CVSS 3.1
7.9 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-78409 7.0

The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.

Record
UBUNTU-CVE-2026-78409
CVSS 3.1
7.0 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVMGASA-2026-0560 No score

Updated util-linux package fixes security vulnerabilities

Additional fix for CVE-2024-28085. Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown. (CVE-2026-53612) Local Privilege Escalation via TOCTOU in mount(8) — Target Path Redirection. (CVE-2026-53613) Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable — nosuid/noexec Bypass in SUID mount(8). (CVE-2026-53614) mount(8) post-mount hooks execute after helper failure. (CVE-2026-76642) nsenter(1), unshare(1) file descriptor leak. (CVE-2026-78408) mount(8) X-mount.subdir symlink escape. (CVE-2026-78409) mount(8) TOCTOU race on source path. (CVE-2026-78410)

Record
MGASA-2026-0560
Updated
2026-11-02
OSVopenSUSE-SU-2026:11870-1 No score

libblkid-devel-2.42.3-1.1 on GA media

These are all security issues fixed in the libblkid-devel-2.42.3-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11870-1
Updated
2026-11-02
OSVROOT-OS-DEBIAN-12-CVE-2026-78409 No score

CVE-2026-78409 in util-linux - Patched by Root

Root has patched CVE-2026-78409 in the util-linux package for Root:Debian:12. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-12-CVE-2026-78409
Updated
2026-11-02
OSVROOT-OS-DEBIAN-13-CVE-2026-78409 No score

CVE-2026-78409 in util-linux - Patched by Root

Root has patched CVE-2026-78409 in the util-linux package for Root:Debian:13. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-13-CVE-2026-78409
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
util-linux
Alpine:v3.24
 before 2.42.3-r0
2.42.3-r0
util-linux
Alpaquita:25
 2.41-r6 up to 2.41.6-r1
2.41.6-r1
util-linux
Alpaquita:stream
 2.39-r14 up to 2.42.3-r1
2.42.3-r1
util-linux
BellSoft Hardened Containers:25
 2.41-r6 up to 2.41.6-r1
2.41.6-r1
util-linux
BellSoft Hardened Containers:stream
 2.39-r14 up to 2.42.3-r1
2.42.3-r1
util-linux
Debian:13
 All versions, plus listed versions
2.41-52.41.1-12.41.1-22.41.1-32.41.1-4
Show 31 moreShow less
2.41.2-12.41.2-22.41.2-32.41.2-42.41.3-12.41.3-22.41.3-32.41.3-42.41.5-0+deb13u12.42-12.42-22.42-32.42-42.42-52.42-62.42.1-12.42.1-22.42.1-32.42.1-42.42.1-52.42.1-62.42.2-12.42.2-22.42.2-32.42.2-42.42.3-12.42.4-12.42~rc1-12.42~rc1-22.42~rc1-32.42~rc2-1
 None known
util-linux
Debian:14
 before 2.42.3-1, plus listed versions
2.41-52.41.1-12.41.1-22.41.1-32.41.1-4
Show 28 moreShow less
2.41.2-12.41.2-22.41.2-32.41.2-42.41.3-12.41.3-22.41.3-32.41.3-42.42-12.42-22.42-32.42-42.42-52.42-62.42.1-12.42.1-22.42.1-32.42.1-42.42.1-52.42.1-62.42.2-12.42.2-22.42.2-32.42.2-42.42~rc1-12.42~rc1-22.42~rc1-32.42~rc2-1
2.42.3-1
util-linux
Mageia:10
From an advisory covering 8 CVEs
 before 2.42.4-1.mga10
2.42.4-1.mga10
libblkid
Red Hat:hummingbird:1
From an advisory covering 4 CVEs
 before 0:2.42.2-3.4.hum1
0:2.42.2-3.4.hum1
libblkid-devel
Red Hat:hummingbird:1
From an advisory covering 4 CVEs
 before 0:2.42.2-3.4.hum1
0:2.42.2-3.4.hum1
Show 29 moreShow less
Affected packages
PackageAffectedFixed
libfdisk
Red Hat:hummingbird:1
From an advisory covering 4 CVEs
 before 0:2.42.2-3.4.hum1
0:2.42.2-3.4.hum1
libfdisk-devel
Red Hat:hummingbird:1
From an advisory covering 4 CVEs
 before 0:2.42.2-3.4.hum1
0:2.42.2-3.4.hum1
liblastlog2
Red Hat:hummingbird:1
From an advisory covering 4 CVEs
 before 0:2.42.2-3.4.hum1
0:2.42.2-3.4.hum1
liblastlog2-devel
Red Hat:hummingbird:1
From an advisory covering 4 CVEs
 before 0:2.42.2-3.4.hum1
0:2.42.2-3.4.hum1
libmount
Red Hat:hummingbird:1
From an advisory covering 4 CVEs
 before 0:2.42.2-3.4.hum1
0:2.42.2-3.4.hum1
libmount-devel
Red Hat:hummingbird:1
From an advisory covering 4 CVEs
 before 0:2.42.2-3.4.hum1
0:2.42.2-3.4.hum1
libsmartcols
Red Hat:hummingbird:1
From an advisory covering 4 CVEs
 before 0:2.42.2-3.4.hum1
0:2.42.2-3.4.hum1
libsmartcols-devel
Red Hat:hummingbird:1
From an advisory covering 4 CVEs
 before 0:2.42.2-3.4.hum1
0:2.42.2-3.4.hum1
libuuid
Red Hat:hummingbird:1
From an advisory covering 4 CVEs
 before 0:2.42.2-3.4.hum1
0:2.42.2-3.4.hum1
libuuid-devel
Red Hat:hummingbird:1
From an advisory covering 4 CVEs
 before 0:2.42.2-3.4.hum1
0:2.42.2-3.4.hum1
python3-libmount
Red Hat:hummingbird:1
From an advisory covering 4 CVEs
 before 0:2.42.2-3.4.hum1
0:2.42.2-3.4.hum1
util-linux
Red Hat:hummingbird:1
From an advisory covering 4 CVEs
 before 0:2.42.2-3.4.hum1
0:2.42.2-3.4.hum1
util-linux-core
Red Hat:hummingbird:1
From an advisory covering 4 CVEs
 before 0:2.42.2-3.4.hum1
0:2.42.2-3.4.hum1
util-linux-i18n
Red Hat:hummingbird:1
From an advisory covering 4 CVEs
 before 0:2.42.2-3.4.hum1
0:2.42.2-3.4.hum1
util-linux-script
Red Hat:hummingbird:1
From an advisory covering 4 CVEs
 before 0:2.42.2-3.4.hum1
0:2.42.2-3.4.hum1
uuidd
Red Hat:hummingbird:1
From an advisory covering 4 CVEs
 before 0:2.42.2-3.4.hum1
0:2.42.2-3.4.hum1
util-linux
Root:Debian:12
 before 2.38.1-5+deb12u3.aikido.17
2.38.1-5+deb12u3.aikido.172.38.1-5+deb12u3.aikido.182.38.1-5+deb12u3.aikido.92.38.1-5+deb12u3.aikido.102.38.1-5+deb12u3.aikido.112.38.1-5+deb12u3.aikido.122.38.1-5+deb12u3.aikido.132.38.1-5+deb12u3.aikido.142.38.1-5+deb12u3.aikido.152.38.1-5+deb12u3.aikido.16
rootio-util-linux
Root:Debian:12
 before 2.38.1-5+deb12u3.aikido.17
2.38.1-5+deb12u3.aikido.172.38.1-5+deb12u3.aikido.182.38.1-5+deb12u3.aikido.92.38.1-5+deb12u3.aikido.102.38.1-5+deb12u3.aikido.112.38.1-5+deb12u3.aikido.122.38.1-5+deb12u3.aikido.132.38.1-5+deb12u3.aikido.142.38.1-5+deb12u3.aikido.152.38.1-5+deb12u3.aikido.16
util-linux
Root:Debian:13
 before 2.41.5-0+deb13u1.aikido.14
2.41.5-0+deb13u1.aikido.142.41.5-0+deb13u1.aikido.72.41.5-0+deb13u1.aikido.82.41.5-0+deb13u1.aikido.92.41.5-0+deb13u1.aikido.102.41.5-0+deb13u1.aikido.112.41.5-0+deb13u1.aikido.152.41.5-0+deb13u1.aikido.122.41.5-0+deb13u1.aikido.13
rootio-util-linux
Root:Debian:13
 before 2.41.5-0+deb13u1.aikido.14
2.41.5-0+deb13u1.aikido.142.41.5-0+deb13u1.aikido.72.41.5-0+deb13u1.aikido.82.41.5-0+deb13u1.aikido.92.41.5-0+deb13u1.aikido.102.41.5-0+deb13u1.aikido.112.41.5-0+deb13u1.aikido.152.41.5-0+deb13u1.aikido.122.41.5-0+deb13u1.aikido.13
util-linux
Ubuntu:14.04:LTS
 All versions, plus listed versions
2.20.1-5.1ubuntu92.20.1-5.1ubuntu102.20.1-5.1ubuntu112.20.1-5.1ubuntu122.20.1-5.1ubuntu13
Show 14 moreShow less
2.20.1-5.1ubuntu142.20.1-5.1ubuntu152.20.1-5.1ubuntu162.20.1-5.1ubuntu172.20.1-5.1ubuntu182.20.1-5.1ubuntu192.20.1-5.1ubuntu202.20.1-5.1ubuntu20.12.20.1-5.1ubuntu20.22.20.1-5.1ubuntu20.32.20.1-5.1ubuntu20.42.20.1-5.1ubuntu20.62.20.1-5.1ubuntu20.72.20.1-5.1ubuntu20.9
 None known
util-linux
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
2.26.2-6ubuntu32.27-3ubuntu12.27.1-1ubuntu22.27.1-1ubuntu32.27.1-1ubuntu4
Show 15 moreShow less
2.27.1-3ubuntu12.27.1-4ubuntu12.27.1-6ubuntu12.27.1-6ubuntu22.27.1-6ubuntu32.27.1-6ubuntu3.12.27.1-6ubuntu3.22.27.1-6ubuntu3.32.27.1-6ubuntu3.42.27.1-6ubuntu3.62.27.1-6ubuntu3.72.27.1-6ubuntu3.82.27.1-6ubuntu3.92.27.1-6ubuntu3.102.27.1-6ubuntu3.10+esm2
 None known
util-linux
Ubuntu:18.04:LTS
 All versions, plus listed versions
2.30.1-0ubuntu42.30.2-0.1ubuntu12.30.2-0.1ubuntu22.30.2-0.1ubuntu32.31.1-0.4ubuntu2
Show 8 moreShow less
2.31.1-0.4ubuntu32.31.1-0.4ubuntu3.12.31.1-0.4ubuntu3.22.31.1-0.4ubuntu3.32.31.1-0.4ubuntu3.42.31.1-0.4ubuntu3.52.31.1-0.4ubuntu3.62.31.1-0.4ubuntu3.7
 None known
util-linux
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
2.34-0.1ubuntu22.34-0.1ubuntu42.34-0.1ubuntu52.34-0.1ubuntu62.34-0.1ubuntu7
Show 8 moreShow less
2.34-0.1ubuntu82.34-0.1ubuntu92.34-0.1ubuntu9.12.34-0.1ubuntu9.32.34-0.1ubuntu9.42.34-0.1ubuntu9.52.34-0.1ubuntu9.62.34-0.1ubuntu9.6+esm1
 None known
util-linux
Ubuntu:22.04:LTS
 All versions, plus listed versions
2.36.1-8ubuntu12.37.2-4ubuntu12.37.2-4ubuntu22.37.2-4ubuntu32.37.2-4ubuntu3.32.37.2-4ubuntu3.42.37.2-4ubuntu3.52.37.2-4ubuntu3.6
 None known
util-linux
Ubuntu:24.04:LTS
 All versions, plus listed versions
2.39.1-4ubuntu22.39.2-6ubuntu12.39.3-6ubuntu22.39.3-9ubuntu22.39.3-9ubuntu4
Show 7 moreShow less
2.39.3-9ubuntu62.39.3-9ubuntu6.12.39.3-9ubuntu6.22.39.3-9ubuntu6.32.39.3-9ubuntu6.42.39.3-9ubuntu6.52.39.3-9ubuntu6.6
 None known
util-linux
Ubuntu:26.10
 All versions, plus listed versions
2.41.3-3ubuntu22.42.2-1ubuntu2
 None known
util-linux
Ubuntu:26.04:LTS
 All versions, plus listed versions
2.41-4ubuntu42.41.2-4ubuntu12.41.2-4ubuntu22.41.2-4ubuntu32.41.3-3ubuntu12.41.3-3ubuntu22.41.3-3ubuntu2.2
 None known
util-linux
openSUSE:Tumbleweed
From an advisory covering 4 CVEs
 before 2.42.3-1.1
2.42.3-1.1

History

History
RecordedChangedSources
affectedOSV
factsNVD
affected, aliases, references
first indexedCVE List, EUVD, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-78409 is a high vulnerability (CVSS 7.0) in Red Hat Enterprise Linux 10, published September 2, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.19%, the 8th percentile. Fixed in util-linux 2.42.3-r0.

References

Show 37 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open