CVE-2026-91205: Cockpit Files Race Condition Vulnerability

CVE-2026-91205 Overview

CVE-2026-91205 is a race condition vulnerability in cockpit-files, a file management component used within the Cockpit web-based server administration interface. A local unprivileged attacker can exploit a time-of-check to time-of-use (TOCTOU) flaw during directory creation with owner assignment. By controlling a writable parent directory, the attacker can replace a newly created directory with a symbolic link before the chown operation is applied. This redirects the ownership change to an arbitrary file on the system, enabling information disclosure or unauthorized modification of sensitive files.

Critical Impact
Successful exploitation allows a local unprivileged user to alter ownership of arbitrary files, potentially compromising sensitive system files and enabling further privilege escalation.

Affected Products

cockpit-files component of the Cockpit server administration interface
Red Hat distributions shipping the vulnerable cockpit-files package
Systems where administrators use Cockpit to perform file operations across trust boundaries

Discovery Timeline

2026-09-18 - CVE-2026-91205 published to the National Vulnerability Database (NVD)
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-91205

Vulnerability Analysis

The flaw is a classic Time-of-Check to Time-of-Use (TOCTOU) race condition classified under [CWE-363]. The cockpit-files component performs directory creation followed by an ownership change as two separate, non-atomic operations. Between these operations, an attacker with write access to the parent directory can substitute the newly created directory with a symbolic link pointing to any file on the filesystem. When the deferred chown executes, it follows the symlink and changes ownership of the target file instead of the intended directory.

Exploitation requires local access, user interaction from a privileged Cockpit user, and precise timing to win the race window. Despite these constraints, the impact on confidentiality and integrity is high, since ownership changes can be redirected to sensitive files such as /etc/shadow, /etc/sudoers, or user SSH configuration files.

Root Cause

The root cause is the absence of atomic file operations during the create-and-own workflow. The code path resolves the target path by name rather than by an open file descriptor. Using path-based chown instead of fchown on a descriptor obtained atomically with O_NOFOLLOW semantics enables the symlink substitution attack.

Attack Vector

The attacker prepares a writable parent directory monitored via inotify or a busy loop. When a Cockpit administrator triggers a directory creation with a specified owner, the attacker races to remove the new directory and create a symbolic link with the same name pointing to a target file. If the substitution occurs before the ownership change, chown follows the symlink and reassigns ownership of the pointed-to file to the attacker or another controlled account. See the Red Hat CVE-2026-91205 Advisory and Red Hat Bug #2466442 Description for further technical detail.

Detection Methods for CVE-2026-91205

Indicators of Compromise

Unexpected ownership changes on sensitive system files such as /etc/shadow, /etc/passwd, or /etc/sudoers
Symbolic links appearing in user-writable directories immediately after Cockpit file operations
Audit log entries showing chown syscalls executed by Cockpit processes on paths outside the intended target

Detection Strategies

Enable Linux Audit rules on the chown, fchown, lchown, symlink, and symlinkat syscalls to correlate rapid sequences originating from Cockpit sessions
Monitor Cockpit application logs for directory creation operations followed by ownership changes on unexpected file paths
Alert on symbolic link creation events within directories that are being actively written to by privileged services

Monitoring Recommendations

Baseline ownership of security-critical files and alert on any deviation from expected values
Track file integrity for /etc, user home directories, and SSH key stores using tools such as AIDE or Tripwire
Correlate Cockpit session activity with filesystem telemetry to identify race-window exploitation attempts

How to Mitigate CVE-2026-91205

Immediate Actions Required

Apply the vendor patch for cockpit-files as soon as it is available through your distribution's update channels
Restrict Cockpit administrative access to trusted users and limit exposure of the Cockpit management interface
Audit ownership of sensitive files and restore any that have been improperly modified

Patch Information

Refer to the Red Hat CVE-2026-91205 Advisory for current patch availability and affected package versions. Track the associated Red Hat Bug #2466442 Description for remediation status.

Workarounds

Avoid performing Cockpit file operations that assign ownership within directories writable by unprivileged users
Disable or restrict the cockpit-files module until a patched version is deployed
Enforce strict directory permissions so that only trusted accounts can write to parent directories used by Cockpit-managed workflows

bash

# Temporarily disable the cockpit-files module until patched
sudo systemctl stop cockpit.socket
sudo dnf remove cockpit-files
# Re-enable Cockpit without the vulnerable component
sudo systemctl start cockpit.socket