CVE-2026-91205

A moderate severity symlink race condition was found in cockpit-files, which affects the cockpit-files package as shipped in Red Hat Enterprise Linux 9 and 10, Red Hat In-Vehicle OS, and Fedora. When a user creates a directory with an owner assignment through Cockpit Files, the privileged directory creation (mkdir) and ownership change (chown) are performed as two separate operations on the same pathname. A local unprivileged attacker who can write to the parent directory can replace the newly created directory entry with a symlink in the window between the two operations, redirecting the privileged ownership change onto an arbitrary file of the attacker's choosing. If the race is won, ownership of sensitive files such as /etc/shadow can be transferred to the attacker, resulting in information disclosure or unauthorized modification of those files. Exploitation is materially constrained: it requires local access, an attacker-writable parent directory, user interaction to trigger the directory-creation flow with owner assignment, and winning the race window. This is reflected in the CVSS 3.1 score of 6.0 (AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N), which is consistent between Red Hat and the upstream CVE record. A fix is being pursued for the actively maintained Red Hat Enterprise Linux and Fedora releases. For the deferred streams (RHEL 9.6.z, RHEL 10.0.z, and the Red Hat In-Vehicle OS streams), the fix is deferred given the moderate severity and the practical difficulty of exploitation; the residual risk is limited to systems where untrusted local users have write access to directories used as parents for the privileged owner-assignment flow.