Description
A flaw was found in cockpit-files. A local unprivileged attacker can exploit a race condition during directory creation with owner assignment. By controlling a writable parent directory, the attacker can replace a newly created directory with a symbolic link (symlink) before the ownership change operation (chown) is applied. This allows the attacker to redirect the ownership change to an arbitrary file, potentially leading to information disclosure or unauthorized modification of sensitive files.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | cockpit-files | 45-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | cockpit-files | No fix yet | — |
| Ubuntu 26.04 LTS | cockpit-files | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | cockpit-files | 36.1-1.el9_8 | RHSA-2026:84595 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | cockpit-files | 36.1-1.el10_2 | ALSA-2026:95570 |
| AlmaLinux 9 | cockpit-files | 36.1-1.el9_8 | ALSA-2026:84595 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | cockpit-files | 36.1-1.el10_2 | RLSA-2026:98566, RLSA-2026:95570 |
| Rocky Linux 9 | cockpit-files | 36.1-1.el9_8 | RLSA-2026:98458, RLSA-2026:84595 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | cockpit-files | 36.1-1.el10_2 | ELSA-2026-95570 |
| Oracle Linux 9 | cockpit-files | 36.1-1.el9_8 | ELSA-2026-84595 |
Advisories 10
- RLSA-2026:98566 Moderate: cockpit-files security update Rocky Linux Security Advisories · Nov 13, 2026
- RLSA-2026:98458 Moderate: cockpit-files security update Rocky Linux Security Advisories · Nov 13, 2026
- WID-SEC-2026-4376 Red Hat Enterprise Linux (cockpit-files): Mehrere Schwachstellen ermöglichen Manipulation von Dateien BSI CERT-Bund (WID) · Nov 11, 2026
- RLSA-2026:95570 Moderate: cockpit-files security update Rocky Linux Security Advisories · Nov 6, 2026
- ALSA-2026:95570 Moderate: cockpit-files security update AlmaLinux Security Advisories · Nov 6, 2026
- ELSA-2026-95570 Moderate: cockpit-files security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Nov 5, 2026
- ALSA-2026:84595 Moderate: cockpit-files security update AlmaLinux Security Advisories · Oct 29, 2026
- RLSA-2026:84595 Moderate: cockpit-files security update Rocky Linux Security Advisories · Oct 20, 2026
- RHSA-2026:84595 Red Hat Security Advisory: cockpit-files security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- ELSA-2026-84595 Moderate: cockpit-files security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Oct 19, 2026
References
- RHSA-2026:84595 vendor-advisory
- RHSA-2026:95570 vendor-advisory
- RHSA-2026:98458 vendor-advisory
- RHSA-2026:98566 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-91205 vdb-entry
- RHBZ#2466442 issue-tracking