CVE-2026-78409 | BDVDB-2026-367353 Detail

Description#

The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-09-02Record published in the CVE List.
2. Version 22026-11-04Most recent update recorded in the CVE List.