CVE-2026-78409

CVE-2026-78409 is a path-resolution flaw in the Linux kernel's handling of the X-mount.subdir mount option: on kernels 6.15 and later, the detached-tree fast path passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW, but that flag neither blocks traversal of intermediate symlinks nor confines resolution to the newly mounted filesystem. A local unprivileged user who is authorized in fstab to mount an entry using X-mount.subdir can plant a symlink so that path resolution escapes the intended filesystem subtree. The attacker can then attach an arbitrary host path at the intended mountpoint, gaining access to filesystem locations outside the designated subdirectory, consistent with the high confidentiality, integrity, and availability impact in the CVSS 7.0 score. Only systems running Linux 6.15 or later in which unprivileged users are permitted to mount fstab entries with X-mount.subdir are affected. There is no known public proof-of-concept, the flaw is not in CISA KEV, and EPSS estimates only a 0.1% probability of exploitation in the next 30 days.

What to do: Check whether systems run kernel 6.15 or later and contain fstab entries with X-mount.subdir that unprivileged users are authorized to mount, and upgrade to a distribution-patched kernel when one becomes available (no fixed version is specified in the available data). Until patched, remove or restrict X-mount.subdir entries and avoid letting unprivileged users control the mount source path. Also inspect the affected subdirectories for attacker-planted symlinks, since successful abuse requires one.