CVE-2026-91203 Red Hat CVE debrief

Who should care

Local system administrators and security teams responsible for Red Hat Enterprise Linux 9 and 10 systems using cockpit-files should assess exposure and apply patches or mitigations.

Why it matters

A local attacker can exploit a symlink race condition in cockpit-files to change file ownership and permissions on arbitrary files, potentially compromising system integrity and availability. Local system administrators and security teams should assess exposure and apply patches or mitigations.

• Potential unauthorized changes in file ownership and permissions on arbitrary files.
• Possible compromise of system integrity and availability by altering system or application states.
• Potential rendering of services unusable due to changed file permissions.

Technical summary

The cockpit-files package is vulnerable to a symlink race condition, allowing local attackers to change file ownership and permissions on arbitrary files. This could lead to unauthorized changes in file ownership and permissions, potentially compromising system integrity and availability. The vulnerability arises during privileged file operations such as changing file ownership or permissions. By manipulating directory entries and winning this race, the attacker can redirect these operations to unintended files, affecting system or application states.

Defensive priority

Medium priority for local system administrators and security teams to assess exposure and apply patches or mitigations.

Recommended defensive actions

• Assess exposure of Red Hat Enterprise Linux 9 and 10 systems using cockpit-files.
• Verify system configurations and apply patches or mitigations as recommended by Red Hat.
• Monitor system logs for suspicious file ownership and permission changes.
• Implement additional security controls to prevent local exploitation.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and source item provide details on the symlink race condition vulnerability in cockpit-files, allowing local attackers to change file ownership and permissions. The NVD entry is currently UNASSIGNED.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.