The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.

CVE-2026-78409 affects the X-mount.subdir option in util-linux on Linux 6.15 and later. The vulnerability arises because the detached-tree fast path passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW, a flag that does not prevent intermediate symlink traversal or confine path resolution to the newly mounted filesystem. A local unprivileged user who has an fstab-authorized X-mount.subdir entry can exploit this flaw to attach an arbitrary host path at the intended mountpoint, effectively escaping the intended filesystem boundary. The issue is a privilege escalation and container/mount namespace escape risk for affected Linux systems. It has been reported via Red Hat, Bugzilla, and the util-linux GitHub security advisories. The vulnerability is tracked under GHSA-8f2p-47x3-43mv in the GitHub Advisory Database. Users running Linux kernel 6.15 or later with util-linux and fstab-configured X-mount.subdir entries should apply available patches immediately.