CVE-2026-78409: Util-linux: util-linux: x-mount.subdir detached-tree resolution can escape via intermediate symlinks
libmount's X-mount.subdir option on Linux >= 6.15 uses a detached-tree fast path (hooksubdir.c / hookmount.c). The configured subdirectory string is passed to opentree() with ATSYMLINKNOFOLLOW, but that flag does not block intermediate-component symlinks and does not provide RESOLVEBENEATH-style containment. An unprivileged user with an fstab-authorized X-mount.subdir= entry can therefore resolve outside the newly mounted filesystem (for example via an intermediate symlink to /etc, or via procfs self/root) and attach a host path at the fstab mountpoint. Restricted-user SUID mount(8) reproduction requires Linux >= 6.15; current HEAD gates that detached path on that kernel version. Introduced by ae19f7546ccb (2025-04-15); first released in util-linux v2.42. Affects v2.42 through v2.42.2 and current master. No upstream fix as of 2026-08-24. Reported upstream by Alex0Young. GHSA-8f2p-47x3-43mv.
Other sources
The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to opentree() with ATSYMLINKNOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.
— MITRE
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Exposure requires util-linux v2.42 through v2.42.2 or current master running on Linux 6.15 or later, where the detached-tree path is enabled. The system must also have an fstab-authorized X-mount.subdir= entry available to an unprivileged user.
What access does an attacker need?
An attacker needs local unprivileged access and authorization to use a relevant fstab entry. No user interaction is required, but exploitation depends on a subdirectory path that traverses an intermediate symlink outside the newly mounted filesystem.
What is the practical impact of successful exploitation?
The attacker can cause a host path, such as one reached through an intermediate symlink to /etc or through procfs self/root, to be attached at the fstab mountpoint. This can result in high confidentiality, integrity, and availability impact.
How can administrators identify potentially affected configurations?
Check whether the host runs Linux 6.15 or later and uses an affected util-linux release, then review fstab-authorized entries for X-mount.subdir=. Entries accessible to restricted users are the relevant exposure point.
Is an upstream fix available?
No upstream fix was available as of 2026-08-24.