The X-mount.subdir option in util-linux uses a detached-tree fast path on Linux 6.15 and later by passing the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. Because that flag does not prevent traversal of intermediate symlinks, a local user can exploit an fstab entry that authorizes the option to mount a host path over the intended mount point, allowing read or write access to privileged files. This flaw is a path-confusion/ directory traversal vulnerability (CWE-59). The description indicates that an attacker who can create or influence an fstab entry that permits X-mount.subdir is able to perform the exploit; it does not state that any user can edit /etc/fstab themselves.

Affected systems include Red Hat Enterprise Linux 7, 8, 9, 10, Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4. The flaw exists in util-linux versions older than 2.41.6 on RHEL 10, older than 2.42.3 on RHEL 8/9, and earlier on RHEL 7, until the packages have been upgraded to the patched releases.

The CVSS score of 7.0 indicates moderate to high severity. The exploit requires local access and the presence of an fstab entry that permits the X-mount.subdir flag. Although the EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, the straightforward local attack path makes it a high-priority issue for administrators to address promptly.