CVE-2026-91203 is a symlink race condition vulnerability in cockpit-files that allows a local attacker to exploit a timing issue during privileged file operations such as changing file ownership or permissions. By manipulating directory entries and winning the race, the attacker can redirect these operations to unintended files, resulting in unauthorized changes to file ownership and permissions. Exploitation requires a privileged Cockpit user to perform file operations within a directory writable by the attacker and winning the timing race. This flaw could compromise system integrity and availability by altering system or application states or rendering services unusable. The vulnerability has a CVSS v3.1 score of 6.0 (medium severity) with attack vector local, attack complexity high, privileges required low, and user interaction required. The issue is tracked as Bugzilla 2465632 and corresponds to CWE-363 (Race Condition Enabling Link Following).

The vulnerability allows unauthorized modification of file ownership and permissions on arbitrary files by exploiting a symlink race condition during privileged file operations. This can compromise system integrity and availability by altering system or application states or rendering services unusable. However, exploitation requires a privileged Cockpit user to perform file operations in a directory writable by the attacker and winning a timing race, which limits the practical impact to specific operational scenarios.

Red Hat has acknowledged the vulnerability and is analyzing affected products. No explicit patch or fix release date is provided in the advisory. Users should monitor Red Hat advisories for updates and apply patches once available. Until then, limit write permissions on directories where privileged Cockpit users perform file operations to trusted users only to reduce risk. No indication that the vulnerability is already mitigated or that no action is required.