Bug 2522607 (CVE-2026-78409)

Summary:	CVE-2026-78409 util-linux: util-linux: X-mount.subdir detached-tree resolution can escape via intermediate symlinks
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	akhatavk, aos-team-art-private, asdas, crizzo, dpaolell, gtanzill, jbuscemi, jdelft, jupierce, kshier, lgarciaa, mbiarnes, ppalepu, ppostler, prdhamdh, rhel-process-autobot, security-response-team, sghai, sidsharm, stcannon, suppawar, teagle, vlaad, watson-tool-maintainers, yguenane
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-24 18:38:15 UTC

libmount's X-mount.subdir option on Linux >= 6.15 uses a detached-tree fast path (hook_subdir.c / hook_mount.c). The configured subdirectory string is passed to open_tree() with AT_SYMLINK_NOFOLLOW, but that flag does not block intermediate-component symlinks and does not provide RESOLVE_BENEATH-style containment. An unprivileged user with an fstab-authorized X-mount.subdir= entry can therefore resolve outside the newly mounted filesystem (for example via an intermediate symlink to /etc, or via procfs self/root) and attach a host path at the fstab mountpoint. Restricted-user SUID mount(8) reproduction requires Linux >= 6.15; current HEAD gates that detached path on that kernel version. Introduced by ae19f7546ccb (2025-04-15); first released in util-linux v2.42. Affects v2.42 through v2.42.2 and current master. No upstream fix as of 2026-08-24. Reported upstream by Alex0Young. GHSA-8f2p-47x3-43mv.