CVE-2026-91203: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-91203 is a symlink race condition vulnerability (CWE-363) in cockpit-files, the file management component of the Cockpit web-based server administration interface. A local attacker can exploit a timing window during privileged chown or chmod operations to redirect those operations to unintended files via a symlink swap. The affected version is cockpit-files-36-1.el10 on Red Hat Enterprise Linux 10. The vulnerability was reported on 2026-05-04, disclosed publicly on 2026-09-18, and carries a CVSS v3.1 base score of 6.0 (Medium) (Red Hat CVE, GitHub Advisory).

The root cause is that multiple cockpit-files source files (src/dialogs/create-file.tsx, src/dialogs/mkdir.tsx, src/upload-button.tsx, src/dialogs/copyPasteOwnership.tsx, and src/dialogs/permissions.tsx) invoke chown and chmod via cockpit.spawn() using mutable pathname strings rather than stable file descriptors, and without the --no-dereference flag. This creates a TOCTOU (time-of-check to time-of-use) window: after the UI action selects a target path but before the privileged metadata change executes, an attacker who controls the directory can atomically replace the target filename with a symlink pointing to an arbitrary file. Because chown without --no-dereference follows symlinks, the privileged operation is then applied to the symlink's target instead of the intended file. Exploitation requires: (1) local access to the system, (2) write access to the directory being operated on, (3) a privileged Cockpit session performing an affected file operation with superuser: "require" or successfully elevated superuser: "try", and (4) winning the timing race (Red Hat Bugzilla, Red Hat CVE).

Successful exploitation allows a local attacker to cause arbitrary changes to file ownership or permissions on any file reachable via a symlink from an attacker-writable directory, including system files or application configuration files. There is no confidentiality impact (no data disclosure), but integrity and availability are both rated High: unauthorized permission or ownership changes can alter system or application state, break services, or render critical files unusable. The scope is limited to the local system (no lateral movement), but the ability to modify ownership of sensitive files could be leveraged for privilege escalation in follow-on attacks (Red Hat CVE, Red Hat Bugzilla).

No public proof-of-concept exploit code or exploit kit integration has been identified, and there is no evidence of in-the-wild exploitation (GitHub Advisory). The EPSS score is 0.0, reflecting very low current exploitation probability (Red Hat CVE). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is non-trivial due to the requirement to win a timing race, have write access to the target directory, and depend on a privileged user performing a specific Cockpit Files UI action.

1. Gain local access: Obtain a low-privileged local account on a system running cockpit-files-36-1.el10 with Cockpit accessible.
2. Identify a writable directory: Locate or create a directory that is both writable by the attacker and accessible through the Cockpit Files UI (e.g., a shared upload directory or world-writable temp path).
3. Place a target file: Create a benign file in the writable directory that will be used as the initial target for the privileged Cockpit operation (e.g., a new file or directory to be created/uploaded).
4. Set up the race loop: In a background process or script, continuously and rapidly replace the target filename in the writable directory with a symlink pointing to the desired victim file (e.g., /etc/passwd or a service configuration file): while true; do ln -sf /etc/target_file /writable_dir/target_name; done
5. Trigger the privileged Cockpit operation: Induce or wait for a privileged Cockpit user to perform an affected file operation (file creation with owner, directory creation, file upload with owner adjustment, or recursive permission/ownership change) on the target path via the Cockpit Files UI.
6. Win the race: If the symlink swap occurs between the UI action and the cockpit.spawn(["chown", ...]) or cockpit.spawn(["chmod", ...]) call, the privileged chown/chmod follows the symlink and applies the ownership or permission change to the victim file instead of the intended target.
7. Verify impact: Confirm that the victim file's ownership or permissions have been altered, potentially enabling further privilege escalation or service disruption (Red Hat Bugzilla).

• Logs: Cockpit session logs showing privileged file operations (chown/chmod with superuser) performed on directories writable by non-privileged users; unexpected ownership or permission changes on system files recorded in audit logs (/var/log/audit/audit.log) with cockpit or cockpit-ws as the initiating process.
• File System: Unexpected changes to ownership or permissions on sensitive files (e.g., /etc/passwd, service config files, application binaries) not attributable to administrative activity; presence of symlinks in shared or world-writable directories pointing to sensitive system files.
• Process: Short-lived chown or chmod processes spawned as root by the Cockpit bridge process (cockpit-bridge) targeting paths outside expected administrative directories; rapid creation and deletion of symlinks in writable directories (detectable via inotifywait or auditd file watch rules).

Red Hat has classified this as Moderate severity and a patch is in progress (no released fixed package version was confirmed at time of disclosure). The proposed fix is to add --no-dereference and -- argument separators to all affected chown and chmod invocations in cockpit-files source code, preventing symlink following on path-based operations (Red Hat Bugzilla). As an interim workaround, Red Hat recommends avoiding the use of privileged ownership or permission changes in directories writable by untrusted users, and restricting or disabling superuser-backed file operations for shared writable paths. Organizations should monitor the Red Hat advisory page for patch availability and apply updates as soon as a fixed package is released (Red Hat CVE).

Red Hat's Product Security team classified the vulnerability as Moderate severity, noting that exploitation is limited to specific, less common operational scenarios requiring a privileged Cockpit user to operate on attacker-writable directories. The issue was discovered by AISLE Research in partnership with Red Hat and was not embargoed due to its local-only, non-trivial prerequisites (Red Hat CVE, Red Hat Bugzilla). No significant broader community or social media discussion has been identified at this time.