Local Privilege Escalation Vulnerability in X-Mount on Linux

CVE-2026-78409

What is CVE-2026-78409?

In Linux versions 6.15 and later, the X-mount.subdir option is susceptible to a local privilege escalation vulnerability. This occurs because the option employs a detached-tree fast path while passing a configured subdirectory to the open_tree() function with the AT_SYMLINK_NOFOLLOW flag. However, this flag fails to prevent intermediate symlink traversal, potentially allowing an unprivileged user with an approved fstab entry to attach a host path to the intended mount point. This flaw highlights a critical security oversight that can be exploited by local users to escalate their privileges and gain unauthorized access.

References