CVE-2026-91205

A flaw was found in cockpit-files. A local unprivileged attacker can exploit a race condition during directory creation with owner assignment. By controlling a writable parent directory, the attacker can replace a newly created directory with a symbolic link (symlink) before the ownership change operation (chown) is applied. This allows the attacker to redirect the ownership change to an arbitrary file, potentially leading to information disclosure or unauthorized modification of sensitive files.

A moderate severity symlink race condition was found in cockpit-files, which affects the cockpit-files package as shipped in Red Hat Enterprise Linux 9 and 10, Red Hat In-Vehicle OS, and Fedora. When a user creates a directory with an owner assignment through Cockpit Files, the privileged directory creation (mkdir) and ownership change (chown) are performed as two separate operations on the same pathname. A local unprivileged attacker who can write to the parent directory can replace the newly created directory entry with a symlink in the window between the two operations, redirecting the privileged ownership change onto an arbitrary file of the attacker's choosing. If the race is won, ownership of sensitive files such as /etc/shadow can be transferred to the attacker, resulting in information disclosure or unauthorized modification of those files. Exploitation is materially constrained: it requires local access, an attacker-writable parent directory, user interaction to trigger the directory-creation flow with owner assignment, and winning the race window. This is reflected in the CVSS 3.1 score of 6.0 (AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N), which is consistent between Red Hat and the upstream CVE record. A fix is being pursued for the actively maintained Red Hat Enterprise Linux and Fedora releases. For the deferred streams (RHEL 9.6.z, RHEL 10.0.z, and the Red Hat In-Vehicle OS streams), the fix is deferred given the moderate severity and the practical difficulty of exploitation; the residual risk is limited to systems where untrusted local users have write access to directories used as parents for the privileged owner-assignment flow.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Avoid using the privileged owner-assignment directory-creation flow in Cockpit Files inside directories that are writable by untrusted local users. Restrict write permissions on shared parent directories, and where directories must remain shared and writable, apply the sticky bit so users cannot replace directory entries they do not own. Creating directories without an owner assignment does not trigger the vulnerable privileged chown path and can be used where the owner-setting feature is not required. Updated packages that address this flaw are being delivered for the actively maintained releases.