This vulnerability in cockpit-files involves a symlink race condition that can be exploited by a local attacker to redirect privileged file operations to unintended files. By winning the timing race, the attacker can cause unauthorized changes to file ownership and permissions, affecting arbitrary files. The flaw requires a privileged Cockpit user to perform file operations in a directory writable by the attacker, limiting the practical impact to specific scenarios. The issue is tracked as CWE-363 (Race Condition Enabling Link Following). Red Hat has published an advisory detailing the flaw and its impact but has not explicitly stated patch availability in the provided content.

Successful exploitation can lead to unauthorized modification of file ownership and permissions on arbitrary files, which may compromise system integrity and availability by altering system or application states or rendering services unusable. The impact is limited by the requirement of a privileged Cockpit user performing file operations in a directory writable by the attacker and winning the timing race.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-91203 for current remediation guidance. Exploitation requires specific conditions including a privileged Cockpit user and writable directories, so limiting such access and monitoring privileged user activities may reduce risk. Customers should follow official Red Hat guidance and apply updates or mitigations as they become available.