The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured
    subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink
    traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-
    authorized X-mount.subdir entry can attach a host path at the intended mountpoint. (CVE-2026-78409)

The version of util-linux installed on the remote host is prior to 2.42.3. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2026-249-03 advisory.

    New util-linux packages are available for Slackware 15.0 and -current to fix security issues.

Tenable has extracted the preceding description block directly from the util-linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured     subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink     traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-     authorized X-mount.subdir entry can attach a host path at the intended mountpoint. (CVE-2026-78409)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
463510	Echo: util-linux: security update to 2.41.5-0+deb13u1+e2	Tenable Cloud Security	Echo Local Security Checks	Local	high
463510	Echo: util-linux: security update to 2.41.5-0+deb13u1+e2	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
343408	Slackware Linux 15.0 / current util-linux Multiple Vulnerabilities (SSA:2026-249-03)	Nessus	Slackware Local Security Checks	Local	high
342606	Linux Distros Unpatched Vulnerability : CVE-2026-78409	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-78409

high

Tenable Plugins

high

high

high

high