CVE-2026-78409: Improper Link Resolution Before File Access ('Link Following') in Red Hat Red Hat Hardened Images

The vulnerability CVE-2026-78409 affects Red Hat Hardened Images where the X-mount.subdir option uses a detached-tree fast path on Linux kernel 6.15 and later. It passes the configured subdirectory to the open_tree() system call with the AT_SYMLINK_NOFOLLOW flag. However, this flag does not prevent traversal of intermediate symbolic links nor does it restrict resolution within the newly mounted filesystem. Consequently, a local unprivileged user who has an fstab-authorized X-mount.subdir entry can exploit this behavior to attach a host path at the intended mountpoint, potentially leading to unauthorized file access or manipulation. Red Hat has issued a security advisory (RHSA-2026:63162) providing updated RPM packages that fix this issue.

The vulnerability allows a local unprivileged user with an authorized fstab X-mount.subdir entry to attach a host path at the intended mountpoint due to improper symlink resolution. This can lead to high impact including confidentiality, integrity, and availability violations as indicated by the CVSS score (7.0) with high impact on confidentiality, integrity, and availability.

Red Hat has released an official security update (RHSA-2026:63162) that fixes this vulnerability in Red Hat Hardened Images. Users should apply the updated RPM packages, including util-linux version 2.42.2-3.4.hum1 and related libraries, as provided in the Red Hat advisory. Patch status is confirmed as fixed in these updated packages. No additional mitigation steps are required beyond applying the official update.