CVE-2026-78409

The record

The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.

Affected packages

Related vulnerabilities

• CVE-2026-79655 A flaw was found in sos clean, a utility within the sos package. CWE-59
• CVE-2026-76845 adm-zip 0.5.9 through 0.6.0 follows symbolic links at the extraction destination. CWE-59
• CVE-2026-70626 NLTK versions before 3.9.4 contain a symlink escape vulnerability in CorpusReader.open()… CWE-59
• CVE-2026-49114 In ONNX before 1.21.0, the 'save_external_data' function builds the external-data file… CWE-59
• CVE-2026-19693 extract-zip through 2.0.1 containment-checks only the parent directory of each archive… CWE-59
• CVE-2026-15059 Local unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC… CWE-59
• CVE-2026-71556 go-git is an extensible git implementation library written in pure Go. CWE-59
• CVE-2026-18508 A flaw was found in GNU tar. CWE-59