CVE-2026-91205 affects cockpit-files and involves a race condition during directory creation and owner assignment. A local unprivileged attacker who controls a writable parent directory can exploit this race condition by replacing a newly created directory with a symbolic link before the chown operation is applied. This allows the attacker to redirect the ownership change to arbitrary files, potentially causing information disclosure or unauthorized modification. The vulnerability is scored 6.0 (medium) with CVSS vector AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N. The issue is documented by Red Hat and has no known exploits in the wild. Affected versions explicitly include cockpit-files versions 36-1 and 39-1. The vendor advisory does not confirm a patch availability but indicates ongoing analysis and typical remediation approaches.

The vulnerability allows a local unprivileged attacker to escalate privileges on file ownership by exploiting a race condition, potentially leading to unauthorized disclosure or modification of sensitive files. The impact affects confidentiality and integrity with no impact on availability. The CVSS score of 6.0 reflects medium severity with high confidentiality and integrity impact but requires local access and high attack complexity.

The vendor advisory does not explicitly confirm the availability of a patch or official fix at this time. Users should monitor the Red Hat advisory for updates regarding patch releases. Until a fix is available, restricting write permissions on parent directories to trusted users can reduce the risk of exploitation. No other specific mitigations are provided by the vendor advisory.