Description

The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.0",
  "pubDate": "2026-09-02T16:17:23.833Z",
  "pubdate": "2026-09-02T16:17:23.833Z",
  "executiveSummary": "A security vulnerability exists in Linux kernel versions 6.15 and later involving the X-mount.subdir mount option. The flaw is a path traversal and improper access control issue arising from the incorrect usage of the AT_SYMLINK_NOFOLLOW flag within the open_tree() system call.\nThis vulnerability allows a local, unprivileged user who possesses fstab-authorized mount permissions to bypass intended directory constraints. By manipulating the subdirectory path, an attacker can attach an arbitrary host path to the mountpoint, effectively escaping the intended filesystem boundary.\nThe risk is categorized as a privilege escalation and filesystem security bypass, as it allows unauthorized access to sensitive host directories that should remain inaccessible to the user. Exploitation requires the attacker to have existing privileges to trigger mount operations via fstab entries. Successful exploitation results in the exposure of files or directories outside the designated subdirectory, compromising the integrity of the system's mount-based isolation mechanisms.",
  "technicalDetails": "The root cause of this vulnerability lies in the implementation of the detached-tree fast path utilized by the X-mount.subdir option in Linux kernel 6.15 and subsequent versions. When the system processes an X-mount.subdir configuration, it invokes the open_tree() system call to resolve the target subdirectory.\nThe implementation incorrectly utilizes the AT_SYMLINK_NOFOLLOW flag under the assumption that it sufficiently restricts the resolution process. However, AT_SYMLINK_NOFOLLOW only prevents the final component of a path from being followed if it is a symbolic link; it does not provide protection against intermediate path traversal or symlink-based redirection that occurs during the lookup phase. Consequently, if the path provided contains intermediate symbolic links, the kernel resolves these links outside of the desired filesystem structure.\nAn unprivileged local attacker can exploit this behavior through the following attack flow: First, the attacker identifies a mountpoint configured in fstab that utilizes the X-mount.subdir option, which the user is permitted to mount. Second, the attacker prepares a malicious directory structure on the host filesystem, incorporating symlinks designed to redirect the open_tree() resolution process to a restricted target location, such as /etc or other sensitive system directories. Third, the attacker initiates the mount operation. During the processing of the X-mount.subdir path, the kernel follows the attacker-controlled symlinks because the AT_SYMLINK_NOFOLLOW flag fails to enforce path resolution constraints on intermediate path elements.\nAs a result, the open_tree() call succeeds in attaching the attacker-chosen host path—which would otherwise be inaccessible—to the intended mountpoint. The mount operation subsequently completes with the malicious path mounted instead of the intended, safe subdirectory. Post-exploitation, the attacker gains the ability to read or modify files within the improperly mounted host directory, effectively subverting the access control policies intended by the system administrator. Because this vulnerability occurs at the kernel level during path resolution, it bypasses standard user-space filesystem permissions if the mount is performed with elevated privileges or via system-level fstab configurations."
}