CVE-2026-91205 Red Hat CVE debrief

Who should care

System administrators and security teams responsible for Red Hat Enterprise Linux 9 and 10 systems using cockpit-files should assess exposure and apply patches or updates as needed.

Why it matters

A local unprivileged attacker can exploit a race condition in cockpit-files to hijack file ownership, potentially leading to information disclosure or unauthorized modification of sensitive files. System administrators and security teams should assess exposure and apply patches or updates as needed.

• Potential information disclosure due to unauthorized file access
• Potential unauthorized modification of sensitive files
• Local privilege escalation vulnerability requiring medium priority attention

Technical summary

A flaw was found in cockpit-files. A local unprivileged attacker can exploit a race condition during directory creation with owner assignment. By controlling a writable parent directory, the attacker can replace a newly created directory with a symbolic link before the ownership change operation is applied. The race condition allows the attacker to redirect the ownership change to an arbitrary file, potentially leading to information disclosure or unauthorized modification of sensitive files in cockpit-files. This issue is a local privilege escalation vulnerability requiring medium priority attention.

Defensive priority

Medium priority for local privilege escalation vulnerability

Recommended defensive actions

• Assess exposure of Red Hat Enterprise Linux 9 and 10 systems using cockpit-files
• Verify version 0:36.1-1.el9_8 or later is installed
• Apply patches or updates provided by Red Hat
• Monitor for suspicious activity related to file ownership changes
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details on the vulnerability, but do not provide information on exploitation or impact. The vendor has provided references to affected versions and patches. A local unprivileged attacker can exploit a race condition during directory creation with owner assignment in cockpit-files. By controlling a writable parent directory, the attacker can replace a newly created directory with a symbolic link before the ownership change operation is applied. This allows the attacker to redirect the ownership to

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.