CVE-2026-52906: 9p: fix access mode flags being ORed instead of replaced
In the Linux kernel, the following vulnerability has been resolved:
9p: fix access mode flags being ORed instead of replaced
Since commit 1f3e4142c0eb ("9p: convert to the new mount API"), v9fsapplyoptions() applies parsed mount flags with |= onto flags already set by v9fssessioninit(). For 9P2000.L, sessioninit sets V9FSACCESSCLIENT as the default, so when the user mounts with "access=user", both bits end up set. Access mode checks compare against exact values, so having both bits set matches neither mode.
This causes v9fsfidlookup() to fall through to the default switch case, using INVALIDUID (nobody/65534) instead of currentfsuid() for all fid lookups. Root is then unable to chown or perform other privileged operations.
Fix by clearing the access mask before applying the user's choice.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Clear the access mask before applying the user's mount access mode in v9fs_apply_options(), so access mode flags are replaced rather than ORed (avoid |= on parsed mount flags).
Linux kernel 9p (v9fs) access mode flags handling in v9fs_apply_options() = Clear the access mask before applying the user's choice (do not OR with |=)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-52906?
CVE-2026-52906 has a risk score of 37, indicating a moderate vulnerability.
How do I fix CVE-2026-52906?
To resolve CVE-2026-52906, ensure that you upgrade to the latest patched version of the Linux kernel that addresses this issue.
What are the implications of CVE-2026-52906?
CVE-2026-52906 may lead to unintended access permissions being applied due to incorrect flag handling in the v9fs subsystem.
Which software is affected by CVE-2026-52906?
CVE-2026-52906 affects the Linux v9fs, specifically the Linux kernel 9P client.
When was CVE-2026-52906 published?
CVE-2026-52906 was published on June 9, 2026.