{"id":"CVE-2026-78409","aliases":["ALPINE-CVE-2026-78409","BELL-CVE-2026-78409","DEBIAN-CVE-2026-78409","EUVD-2026-70107","MGASA-2026-0560","RHSA-2026:63162","ROOT-OS-DEBIAN-12-CVE-2026-78409","ROOT-OS-DEBIAN-13-CVE-2026-78409","UBUNTU-CVE-2026-78409","openSUSE-SU-2026:11870-1"],"status":"published","title":"Util-linux: util-linux: x-mount.subdir detached-tree resolution can escape via intermediate symlinks","description":"The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.","severity":{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00189,"percentile":0.086,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-59"],"published":"2026-09-02T15:11:47Z","modified":"2026-11-09T12:52:31Z","fixes":[{"ecosystem":"Alpine:v3.24","package":"util-linux","fixed_in":["2.42.3-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"util-linux","fixed_in":["2.41.6-r1"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"util-linux","fixed_in":["2.42.3-r1"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:25","package":"util-linux","fixed_in":["2.41.6-r1"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"util-linux","fixed_in":["2.42.3-r1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"util-linux","fixed_in":["2.42.3-1"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"util-linux","fixed_in":["2.38.1-5+deb12u3.aikido.17","2.38.1-5+deb12u3.aikido.18","2.38.1-5+deb12u3.aikido.9","2.38.1-5+deb12u3.aikido.10","2.38.1-5+deb12u3.aikido.11","2.38.1-5+deb12u3.aikido.12","2.38.1-5+deb12u3.aikido.13","2.38.1-5+deb12u3.aikido.14","2.38.1-5+deb12u3.aikido.15","2.38.1-5+deb12u3.aikido.16"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"rootio-util-linux","fixed_in":["2.38.1-5+deb12u3.aikido.17","2.38.1-5+deb12u3.aikido.18","2.38.1-5+deb12u3.aikido.9","2.38.1-5+deb12u3.aikido.10","2.38.1-5+deb12u3.aikido.11","2.38.1-5+deb12u3.aikido.12","2.38.1-5+deb12u3.aikido.13","2.38.1-5+deb12u3.aikido.14","2.38.1-5+deb12u3.aikido.15","2.38.1-5+deb12u3.aikido.16"],"sources":["osv"]},{"ecosystem":"Root:Debian:13","package":"util-linux","fixed_in":["2.41.5-0+deb13u1.aikido.14","2.41.5-0+deb13u1.aikido.7","2.41.5-0+deb13u1.aikido.8","2.41.5-0+deb13u1.aikido.9","2.41.5-0+deb13u1.aikido.10","2.41.5-0+deb13u1.aikido.11","2.41.5-0+deb13u1.aikido.15","2.41.5-0+deb13u1.aikido.12","2.41.5-0+deb13u1.aikido.13"],"sources":["osv"]},{"ecosystem":"Root:Debian:13","package":"rootio-util-linux","fixed_in":["2.41.5-0+deb13u1.aikido.14","2.41.5-0+deb13u1.aikido.7","2.41.5-0+deb13u1.aikido.8","2.41.5-0+deb13u1.aikido.9","2.41.5-0+deb13u1.aikido.10","2.41.5-0+deb13u1.aikido.11","2.41.5-0+deb13u1.aikido.15","2.41.5-0+deb13u1.aikido.12","2.41.5-0+deb13u1.aikido.13"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.24","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.42.3-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.41-r6"},{"fixed":"2.41.6-r1"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.39-r14"},{"fixed":"2.42.3-r1"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:25","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.41-r6"},{"fixed":"2.41.6-r1"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.39-r14"},{"fixed":"2.42.3-r1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.41-5","2.41.1-1","2.41.1-2","2.41.1-3","2.41.1-4","2.41.2-1","2.41.2-2","2.41.2-3","2.41.2-4","2.41.3-1","2.41.3-2","2.41.3-3","2.41.3-4","2.41.5-0+deb13u1","2.42-1","2.42-2","2.42-3","2.42-4","2.42-5","2.42-6","2.42.1-1","2.42.1-2","2.42.1-3","2.42.1-4","2.42.1-5","2.42.1-6","2.42.2-1","2.42.2-2","2.42.2-3","2.42.2-4","2.42.3-1","2.42.4-1","2.42~rc1-1","2.42~rc1-2","2.42~rc1-3","2.42~rc2-1"]},{"source":"osv","ecosystem":"Debian:14","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.42.3-1"}]}],"versions":["2.41-5","2.41.1-1","2.41.1-2","2.41.1-3","2.41.1-4","2.41.2-1","2.41.2-2","2.41.2-3","2.41.2-4","2.41.3-1","2.41.3-2","2.41.3-3","2.41.3-4","2.42-1","2.42-2","2.42-3","2.42-4","2.42-5","2.42-6","2.42.1-1","2.42.1-2","2.42.1-3","2.42.1-4","2.42.1-5","2.42.1-6","2.42.2-1","2.42.2-2","2.42.2-3","2.42.2-4","2.42~rc1-1","2.42~rc1-2","2.42~rc1-3","2.42~rc2-1"]},{"source":"osv","ecosystem":"Mageia:10","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.42.4-1.mga10"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libblkid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.42.2-3.4.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libblkid-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.42.2-3.4.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libfdisk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.42.2-3.4.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libfdisk-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.42.2-3.4.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"liblastlog2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.42.2-3.4.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"liblastlog2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.42.2-3.4.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libmount","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.42.2-3.4.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libmount-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.42.2-3.4.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libsmartcols","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.42.2-3.4.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libsmartcols-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.42.2-3.4.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libuuid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.42.2-3.4.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libuuid-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.42.2-3.4.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3-libmount","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.42.2-3.4.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.42.2-3.4.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"util-linux-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.42.2-3.4.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"util-linux-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.42.2-3.4.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"util-linux-script","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.42.2-3.4.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"uuidd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.42.2-3.4.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Root:Debian:12","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.38.1-5+deb12u3.aikido.17"},{"fixed":"2.38.1-5+deb12u3.aikido.18"},{"fixed":"2.38.1-5+deb12u3.aikido.9"},{"fixed":"2.38.1-5+deb12u3.aikido.10"},{"fixed":"2.38.1-5+deb12u3.aikido.11"},{"fixed":"2.38.1-5+deb12u3.aikido.12"},{"fixed":"2.38.1-5+deb12u3.aikido.13"},{"fixed":"2.38.1-5+deb12u3.aikido.14"},{"fixed":"2.38.1-5+deb12u3.aikido.15"},{"fixed":"2.38.1-5+deb12u3.aikido.16"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"rootio-util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.38.1-5+deb12u3.aikido.17"},{"fixed":"2.38.1-5+deb12u3.aikido.18"},{"fixed":"2.38.1-5+deb12u3.aikido.9"},{"fixed":"2.38.1-5+deb12u3.aikido.10"},{"fixed":"2.38.1-5+deb12u3.aikido.11"},{"fixed":"2.38.1-5+deb12u3.aikido.12"},{"fixed":"2.38.1-5+deb12u3.aikido.13"},{"fixed":"2.38.1-5+deb12u3.aikido.14"},{"fixed":"2.38.1-5+deb12u3.aikido.15"},{"fixed":"2.38.1-5+deb12u3.aikido.16"}]}]},{"source":"osv","ecosystem":"Root:Debian:13","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.41.5-0+deb13u1.aikido.14"},{"fixed":"2.41.5-0+deb13u1.aikido.7"},{"fixed":"2.41.5-0+deb13u1.aikido.8"},{"fixed":"2.41.5-0+deb13u1.aikido.9"},{"fixed":"2.41.5-0+deb13u1.aikido.10"},{"fixed":"2.41.5-0+deb13u1.aikido.11"},{"fixed":"2.41.5-0+deb13u1.aikido.15"},{"fixed":"2.41.5-0+deb13u1.aikido.12"},{"fixed":"2.41.5-0+deb13u1.aikido.13"}]}]},{"source":"osv","ecosystem":"Root:Debian:13","package":"rootio-util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.41.5-0+deb13u1.aikido.14"},{"fixed":"2.41.5-0+deb13u1.aikido.7"},{"fixed":"2.41.5-0+deb13u1.aikido.8"},{"fixed":"2.41.5-0+deb13u1.aikido.9"},{"fixed":"2.41.5-0+deb13u1.aikido.10"},{"fixed":"2.41.5-0+deb13u1.aikido.11"},{"fixed":"2.41.5-0+deb13u1.aikido.15"},{"fixed":"2.41.5-0+deb13u1.aikido.12"},{"fixed":"2.41.5-0+deb13u1.aikido.13"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.20.1-5.1ubuntu9","2.20.1-5.1ubuntu10","2.20.1-5.1ubuntu11","2.20.1-5.1ubuntu12","2.20.1-5.1ubuntu13","2.20.1-5.1ubuntu14","2.20.1-5.1ubuntu15","2.20.1-5.1ubuntu16","2.20.1-5.1ubuntu17","2.20.1-5.1ubuntu18","2.20.1-5.1ubuntu19","2.20.1-5.1ubuntu20","2.20.1-5.1ubuntu20.1","2.20.1-5.1ubuntu20.2","2.20.1-5.1ubuntu20.3","2.20.1-5.1ubuntu20.4","2.20.1-5.1ubuntu20.6","2.20.1-5.1ubuntu20.7","2.20.1-5.1ubuntu20.9"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.26.2-6ubuntu3","2.27-3ubuntu1","2.27.1-1ubuntu2","2.27.1-1ubuntu3","2.27.1-1ubuntu4","2.27.1-3ubuntu1","2.27.1-4ubuntu1","2.27.1-6ubuntu1","2.27.1-6ubuntu2","2.27.1-6ubuntu3","2.27.1-6ubuntu3.1","2.27.1-6ubuntu3.2","2.27.1-6ubuntu3.3","2.27.1-6ubuntu3.4","2.27.1-6ubuntu3.6","2.27.1-6ubuntu3.7","2.27.1-6ubuntu3.8","2.27.1-6ubuntu3.9","2.27.1-6ubuntu3.10","2.27.1-6ubuntu3.10+esm2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.30.1-0ubuntu4","2.30.2-0.1ubuntu1","2.30.2-0.1ubuntu2","2.30.2-0.1ubuntu3","2.31.1-0.4ubuntu2","2.31.1-0.4ubuntu3","2.31.1-0.4ubuntu3.1","2.31.1-0.4ubuntu3.2","2.31.1-0.4ubuntu3.3","2.31.1-0.4ubuntu3.4","2.31.1-0.4ubuntu3.5","2.31.1-0.4ubuntu3.6","2.31.1-0.4ubuntu3.7"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.34-0.1ubuntu2","2.34-0.1ubuntu4","2.34-0.1ubuntu5","2.34-0.1ubuntu6","2.34-0.1ubuntu7","2.34-0.1ubuntu8","2.34-0.1ubuntu9","2.34-0.1ubuntu9.1","2.34-0.1ubuntu9.3","2.34-0.1ubuntu9.4","2.34-0.1ubuntu9.5","2.34-0.1ubuntu9.6","2.34-0.1ubuntu9.6+esm1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.41.3-3ubuntu2","2.42.2-1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.41-4ubuntu4","2.41.2-4ubuntu1","2.41.2-4ubuntu2","2.41.2-4ubuntu3","2.41.3-3ubuntu1","2.41.3-3ubuntu2","2.41.3-3ubuntu2.2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.42.3-1.1"}]}],"bundled":4}],"products":[{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat hardened images"},{"vendor":"red hat","product":"red hat openshift container platform 4"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:63162","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-78409","tags":["vdb-entry","x_refsource_REDHAT","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2522607","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv","tags":["exploit","article","report"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-78409","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-78409","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-78409","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0560.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35435","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PG6GOWBLE22WLLWIN3COAYZZJEQKI62R/","tags":["web"]},{"url":"https://github.com/util-linux/util-linux/security/advisories/GHSA-g8wm-75wr-g2vh","tags":["advisory"]},{"url":"https://github.com/util-linux/util-linux/security/advisories/GHSA-8gj5-72r3-428g","tags":["advisory"]},{"url":"https://github.com/util-linux/util-linux/security/advisories/GHSA-67r7-8m5w-22wx","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/YOV3MY4NAWRGHXQY54MU5FVY6DSEV4CV/","tags":["web"]},{"url":"https://lists.debian.org/debian-security-announce/2026/msg00353.html","tags":["web"]},{"url":"https://ubuntu.com/security/notices/USN-8702-1","tags":["advisory"]},{"url":"https://www.openwall.com/lists/oss-security/2026/09/04/6","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/09/05/2","tags":["web"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-76642","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-78408","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-78410","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_63162.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2521999","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-76642","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76642","tags":["advisory"]},{"url":"https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2522497","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-78408","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78408","tags":["advisory"]},{"url":"https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-78409","tags":["advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78409","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2522684","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-78410","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78410","tags":["advisory"]},{"url":"https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m","tags":["article"]},{"url":"https://ubuntu.com/security/CVE-2026-78409","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-76642","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78408","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78409","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78410","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-78409","title":"Util-linux: util-linux: x-mount.subdir detached-tree resolution can escape via intermediate symlinks","description":"The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.","status":"published","published":"2026-09-02T15:11:47.184Z","modified":"2026-10-21T17:51:49.053Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T13:34:59.78118Z"}],"euvd":[{"id":"EUVD-2026-70107","description":"The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.","status":"published","published":"2026-09-02T15:11:47Z","modified":"2026-10-21T17:51:49Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:59:36.259658Z"}],"nvd":[{"id":"CVE-2026-78409","description":"The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.","status":"published","published":"2026-09-02T16:17:23.833Z","modified":"2026-11-05T00:17:28.61Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-59"],"updated_at":"2026-11-05T01:45:10.861521Z"}],"osv":[{"id":"ALPINE-CVE-2026-78409","description":"The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.","status":"published","published":"2026-09-02T16:17:23.833Z","modified":"2026-10-01T02:17:49.410777203Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:50.764331Z"},{"id":"BELL-CVE-2026-78409","status":"published","published":"2026-09-05T06:06:14.981659Z","modified":"2026-10-02T07:15:02.40091699Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:26.041478Z"},{"id":"DEBIAN-CVE-2026-78409","description":"The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.","status":"published","published":"2026-09-02T16:17:23.833Z","modified":"2026-11-05T09:47:29.595365133Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-05T13:31:24.64316Z"},{"id":"RHSA-2026:63162","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-09-04T10:13:58Z","modified":"2026-10-17T10:17:14Z","cvss":[{"version":"3.1","score":7.9,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"UBUNTU-CVE-2026-78409","description":"The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.","status":"published","published":"2026-09-02T16:17:00Z","modified":"2026-11-09T12:52:31.04377068Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-09T13:26:11.50143Z"},{"id":"MGASA-2026-0560","title":"Updated util-linux package fixes security vulnerabilities","description":"Additional fix for CVE-2024-28085.\nLocal Privilege Escalation via TOCTOU in mount(8) hook_owner.c\nchmod/chown. (CVE-2026-53612)\nLocal Privilege Escalation via TOCTOU in mount(8) — Target Path\nRedirection. (CVE-2026-53613)\nLocal Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment\nVariable — nosuid/noexec Bypass in SUID mount(8). (CVE-2026-53614)\nmount(8) post-mount hooks execute after helper failure. (CVE-2026-76642)\nnsenter(1), unshare(1) file descriptor leak. (CVE-2026-78408)\nmount(8) X-mount.subdir symlink escape. (CVE-2026-78409)\nmount(8) TOCTOU race on source path. (CVE-2026-78410)\n","status":"published","published":"2026-10-27T20:02:56Z","modified":"2026-10-27T20:15:03.204676304Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:11870-1","title":"libblkid-devel-2.42.3-1.1 on GA media","description":"These are all security issues fixed in the libblkid-devel-2.42.3-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-23T00:00:00Z","modified":"2026-09-24T18:23:15.542670035Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2026-78409","title":"CVE-2026-78409 in util-linux - Patched by Root","description":"Root has patched CVE-2026-78409 in the util-linux package for Root:Debian:12. Multiple fixed versions available.","status":"published","published":"2026-10-16T09:26:03Z","modified":"2026-10-16T10:15:05.756482516Z","updated_at":"2026-11-02T15:53:32.570806Z"},{"id":"ROOT-OS-DEBIAN-13-CVE-2026-78409","title":"CVE-2026-78409 in util-linux - Patched by Root","description":"Root has patched CVE-2026-78409 in the util-linux package for Root:Debian:13. Multiple fixed versions available.","status":"published","published":"2026-10-16T09:34:01Z","modified":"2026-10-16T10:15:06.661192053Z","updated_at":"2026-11-02T15:53:33.681527Z"}]}}