ECHO-3EB2-A6D4-7B02 The detached-tree X-mount.subdir path arrived in 2.42 (ae19f7546); our libmount has no AT_SYMLINK_NOFOLLOW, no api->subdir in hook_mount.c and no 6.15 logic. Upstream shipped 2.41.6 the same day as 2.42.3 with the other three CVEs and deliberately not this one. Debian marks trixie vulnerable but also bookworm 2.38.1, which predates the path entirely. https://security-tracker.debian.org/tracker/CVE-2026-78409

Bulletin has no description...