libmount's X-mount.subdir option on Linux >= 6.15 uses a detached-tree fast path (hook_subdir.c / hook_mount.c). The configured subdirectory string is passed to open_tree() with AT_SYMLINK_NOFOLLOW, but that flag does not block intermediate-component symlinks and does not provide RESOLVE_BENEATH-style containment. An unprivileged user with an fstab-authorized X-mount.subdir= entry can therefore resolve outside the newly mounted filesystem (for example via an intermediate symlink to /etc, or via procfs self/root) and attach a host path at the fstab mountpoint. Restricted-user SUID mount(8) reproduction requires Linux >= 6.15; current HEAD gates that detached path on that kernel version. Introduced by ae19f7546ccb (2025-04-15); first released in util-linux v2.42. Affects v2.42 through v2.42.2 and current master. No upstream fix as of 2026-08-24. Reported upstream by Alex0Young. GHSA-8f2p-47x3-43mv.