util-linux CVE-2026-78409

Three specific conditions must all be met: (1) the target host must be running Linux kernel 6.15 or later, specifically the code path that uses open_tree() for X-mount.subdir - earlier kernels use a different implementation that may not be affected; (2) /etc/fstab must contain an entry authorizing the attacker's user or group to perform a mount using the X-mount.subdir option, which is a non-default configuration requiring explicit administrator action; and (3) the attacker must be able to replace or create a symlink at an intermediate component of the configured subdirectory path prior to the mount operation, requiring write access to that intermediate directory. Default installations of RHEL or util-linux without explicit X-mount.subdir fstab entries are not affected. No network attack vector exists - exploitation is strictly local. The kernel version requirement limits the exposed population to systems running newer kernels or Red Hat's backported implementation.

CVSS 7.0 with AV:L/AC:H/PR:L reflects real constraints: the attack is local-only and requires two preconditions - a pre-existing fstab-authorized X-mount.subdir entry and attacker control over an intermediate path component. In typical desktop or server deployments these conditions are uncommon, but in rootless container and OpenShift environments where per-user fstab entries are a supported pattern, both conditions become more plausible and the impact escalates to a full container-to-host escape (C:H/I:H/A:H). The 'Information Disclosure' tag attached to this CVE is a significant mislabeling - the full C:H/I:H/A:H CVSS impact represents privilege escalation and arbitrary host-path access, not mere information disclosure. No KEV listing, no POC, and no EPSS data are available, placing this in a 'real threat, limited immediate exploitation pressure' category. The kernel 6.15 version prerequisite further narrows the currently vulnerable population to systems running newer kernels or Red Hat's backport, though RHEL 9 and 10 with recent kernel updates may satisfy this. Priority for remediation should be highest in OpenShift and container-heavy environments.

A low-privileged local user on an RHEL 10 or OpenShift node discovers a fstab entry granting them a mount with X-mount.subdir=/home/user/data/subdir; they replace the intermediate 'data' directory with a symlink pointing to /etc before triggering the mount operation, causing open_tree() to resolve the subtree root to /etc on the host instead of the intended subdirectory. The user then reads or overwrites sensitive host configuration files such as /etc/passwd or /etc/shadow, achieving full privilege escalation. No public proof-of-concept has been reported, but the attack concept follows directly from documented open_tree() API semantics.