CVE-2026-78409

Name of the Vulnerable Software and Affected Versions Linux Kernel versions 6.15 and later

Description An issue exists where the X-mount.subdir option utilizes a detached-tree fast path and passes the configured subdirectory to the open tree() function using the AT SYMLINK NOFOLLOW flag. This flag fails to prevent intermediate symlink traversal or ensure that resolution remains within the newly mounted filesystem. Consequently, a local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.