CVE-2026-91205: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-91205 is a race condition vulnerability in cockpit-files that allows a local unprivileged attacker to hijack file ownership via symlink substitution. During directory creation with owner assignment, the create_directory() function performs mkdir and chown as two separate operations on the same pathname; an attacker who controls a writable parent directory can replace the newly created directory with a symlink between these two calls, redirecting the chown to an arbitrary file. The affected component is cockpit-files (confirmed version cockpit-files-36-1.el10 on Red Hat Enterprise Linux 10). It was disclosed on September 18, 2026, with a CVSS v3.1 base score of 6.0 (Medium) (Red Hat CVE, Github Advisory).

The root cause is CWE-363 (Race Condition Enabling Link Following): the create_directory() function in src/dialogs/mkdir.tsx spawns mkdir and then chown as two sequential privileged shell commands without atomicity or symlink-safe flags (Red Hat Bugzilla). Between these two calls, an attacker controlling the parent directory can atomically replace the newly created directory entry with a symlink (e.g., pointing to /etc/shadow), causing the subsequent chown — run with superuser privileges — to change ownership of the symlink target instead of the intended directory. Exploitation requires: (1) a local low-privileged account, (2) write control over the parent directory of the path being created, (3) a legitimate user triggering the owner-assignment directory creation flow in Cockpit Files, and (4) winning the narrow timing race between mkdir and chown. The proposed fix is to add --no-dereference to the chown invocation so it does not follow symlinks (Red Hat Bugzilla).

Successful exploitation allows an attacker to redirect a superuser-level chown operation to an arbitrary file, resulting in high confidentiality impact (e.g., gaining read access to sensitive files like /etc/shadow) and high integrity impact (e.g., gaining write control over files the attacker should not own). Availability is not directly affected. The scope is unchanged, meaning the impact is confined to the local system, but ownership of critical system files could enable privilege escalation or further compromise (Red Hat CVE, Red Hat Bugzilla).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the disclosure date (Github Advisory). The EPSS score is 0.0, indicating very low probability of near-term exploitation (Red Hat CVE). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is materially constrained by the requirement for local access, user interaction, a narrow race window, and a specific writable-parent-directory precondition, making opportunistic mass exploitation unlikely (Red Hat Bugzilla).

1. Prepare attacker-controlled directory: As a low-privileged local attacker, create or obtain write access to a directory that will serve as the parent for the target path, e.g., sudo mkdir -p /home/attacker/share && sudo chown attacker:attacker /home/attacker/share && sudo chmod 0777 /home/attacker/share.
2. Launch race loop: Run a continuous loop that removes any existing entry at the target name and replaces it with a symlink to a sensitive file: while true; do rm -rf /home/attacker/share/poc; ln -s /etc/shadow /home/attacker/share/poc 2>/dev/null; done
3. Trigger vulnerable code path: Convince or wait for a legitimate user with Cockpit Files superuser access to browse to /home/attacker/share/ and create a new directory named poc using the owner-assignment flow (which triggers the privileged mkdir + chown sequence).
4. Win the race: If the symlink is in place when chown executes, the ownership of /etc/shadow (or the chosen target) is changed to the specified owner, redirecting control of that file.
5. Verify and exploit: Check ls -l /etc/shadow to confirm ownership change; with ownership of a sensitive file, the attacker can read or modify its contents to achieve privilege escalation or credential theft (Red Hat Bugzilla).

• File System: Unexpected ownership changes on sensitive files such as /etc/shadow, /etc/passwd, or other root-owned files — detectable via ls -l or file integrity monitoring tools.
• File System: Presence of symlinks in shared or world-writable directories pointing to sensitive system files (e.g., ln -s /etc/shadow /some/shared/dir/newdir).
• Logs: System audit logs (/var/log/audit/audit.log) showing chown syscalls on sensitive files initiated by the Cockpit service (cockpit-bridge) or sudo/superuser context, where the target file is not a newly created directory.
• Logs: Cockpit session logs recording directory creation events in world-writable or attacker-controlled parent directories with owner-assignment enabled.
• Process: Rapid, repeated rm and ln system calls from a low-privileged user process in a shared directory, indicative of a race condition loop (Red Hat Bugzilla).

A patch has not yet been released in a fixed package version as of the disclosure date; the Bugzilla entry lists the status as NEW with no fixed version confirmed (Red Hat Bugzilla). The proposed code fix is to replace chown owner path with chown --no-dereference owner path in src/dialogs/mkdir.tsx to prevent symlink following during ownership assignment (Red Hat Bugzilla). Operational workarounds include: (1) avoid using the privileged owner-setting directory creation flow inside attacker-writable or world-writable directories; (2) apply sticky-bit protections (chmod +t) on shared parent directories to prevent non-owners from removing or replacing entries; (3) restrict write access on parent directories used with Cockpit Files; and (4) monitor for unexpected ownership changes on sensitive files using file integrity monitoring (Red Hat CVE).

The vulnerability was discovered and reported by AISLE Research in partnership with Red Hat, and Red Hat Product Security acknowledged the finding (Red Hat CVE). Red Hat classified the impact as Moderate, noting that exploitation is materially constrained by local access requirements, user interaction, race condition difficulty, and specific filesystem preconditions (Red Hat Bugzilla). No significant broader community commentary or media coverage has been identified beyond standard CVE aggregator entries.