Executive brief
A flaw in the Linux kernel's X-mount.subdir feature (6.15 and later) allows local users to bypass mount directory restrictions through intermediate symlink traversal. An unprivileged user with fstab authorization for a subdirectory mount can attach arbitrary host paths at the intended mountpoint, potentially granting unauthorized filesystem access and data exposure.
Technical details
The X-mount.subdir option uses a detached-tree fast path that passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. However, this flag does not prevent intermediate symlink traversal during path resolution, nor does it constrain resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can exploit this to attach a host path at the intended mountpoint, bypassing the intended subdirectory isolation. Attack requires local filesystem access and an existing fstab entry but no elevated privileges. Patches are available in Linux kernel 6.15+.
Affected products
- Linux Linux Kernel 6.15 and later
Timeline
- 2026-09-02: disclosed