Symlink Race Condition in Cockpit-Files Affects Red Hat Systems
CVE-2026-91203

6MEDIUM

Key Information:

Vendor

Red Hat
Status
Red Hat Enterprise Linux 10
Red Hat Enterprise Linux 9
Vendor
CVE Published:
18 September 2026

What is CVE-2026-91203?

A flaw in cockpit-files allows local attackers to exploit a timing issue, known as a symlink race condition, during privileged file operations like changing ownership or permissions. By manipulating directory entries and winning the timing race, attackers can redirect these operations to unintended files, leading to unauthorized changes. This vulnerability can compromise system integrity and availability, posing risks by altering system or application states or making services unusable.

References

https://access.redhat.com/security/cve/CVE-2026-91203
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2465632
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
6
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

This issue was discovered by Found by AISLE in partnership with Red Hat.
.