CVE-2026-52906: Linux 9P Filesystem Access Mode Flag Corruption

Technical summary

The vulnerability stems from commit 1f3e4142c0eb, which refactored 9P mount handling to use the new kernel mount API. The flaw is in v9fs_apply_options(), which uses bitwise OR (|=) to merge user-supplied mount flags onto flags already initialized by v9fs_session_init(). For 9P2000.L protocol instances, session_init() sets V9FS_ACCESS_CLIENT as the default access mode. When a user provides an explicit access mode parameter (e.g., 'access=user'), the OR operation causes both the default and user-specified bits to be set. Access mode validation in v9fs_fid_lookup() performs exact value comparisons against defined constants, so the presence of multiple bits causes matches to fail. The function then defaults to using INVALID_UID rather than the caller's actual fsuid, breaking privilege escalation and root-level filesystem operations. The fix clears the access mode mask before applying the user's selection, ensuring only one access mode is active at any time.

Business impact

This vulnerability affects administrators and users relying on 9P network filesystems, commonly used in containerized and virtualized environments (Docker, QEMU, etc.). The inability for root to execute privileged operations on mounted 9P shares—such as changing ownership, modifying permissions, or managing container security contexts—can break automation, deployment pipelines, and security enforcement mechanisms. Organizations using 9P for container storage or virtual machine filesystem sharing may experience deployment failures, inability to enforce security policies, and operational disruption until patched.

Affected systems

The Linux kernel is the sole affected component. All kernel versions from commit 1f3e4142c0eb (merged in kernel v5.10-rc1) through the patch date are potentially vulnerable. The issue manifests only when a user explicitly specifies an access mode mount option on a 9P filesystem; systems using 9P with default settings may not exhibit the problem. Verify your kernel version against the vendor advisory to confirm patch availability.

Exploitability

This vulnerability does not require privilege escalation—it emerges during normal administrative use of 9P filesystems with explicit mount options. Any user with the ability to mount a 9P share can trigger the condition. However, exploitation requires local access and the ability to mount filesystems; remote exploitation is not feasible. The impact is high because it breaks fundamental filesystem privilege model enforcement, though triggering it is straightforward and unambiguous (mount with an access option and attempt a privileged operation).

Remediation

Apply the kernel patch that corrects v9fs_apply_options() to clear the access mode mask before OR-ing in the user's selected mode. Coordinate with your Linux distribution for backported fixes to stable kernel branches you operate. Interim mitigations include avoiding explicit 'access=' mount options when possible or reviewing container and virtualization configurations to ensure 9P mounts are not critical to privilege-dependent operations.

Patch guidance

Identify your current kernel version (uname -r) and cross-reference against your distribution's advisory. Stable and LTS kernel branches will receive backported fixes; check with your vendor (Red Hat, Canonical, SUSE, etc.) for patched kernel packages. Testing should include mounting 9P shares with various access modes ('access=user', 'access=client', etc.) and verifying that root-level operations (chown, chmod, etc.) function correctly post-patch. Validate that non-root users cannot escalate permissions unintentionally as a side effect of the fix.

Detection guidance

Review kernel logs (dmesg) for 9P filesystem mount operations paired with subsequent permission denial errors. Audit container or VM configurations for 9P mount usage; grep for '9p', 'v9fs', or 'protocol=9p' in container runtimes, libvirt XML definitions, or kernel command-line arguments. Monitor for failed system calls (strace or seccomp logs) involving chown, chmod, or other privilege-requiring operations on 9P-mounted paths, especially from uid 0. Correlate mount timestamps with operational failures (e.g., container security policy enforcement, ownership setup) to confirm exposure.

Why prioritize this

This is a HIGH-severity vulnerability (CVSS 7.7) because it directly breaks filesystem privilege enforcement, allowing local attackers to disrupt critical administrative operations. While it requires local mount capability and does not grant unintended privilege, the impact on container orchestration, virtualization, and filesystem security policy is significant. Organizations heavy on containerized or VM-based 9P usage should prioritize patching; others with no 9P deployments can deprioritize. The ease of triggering it (simply mounting with an explicit access option) combined with its severity warrants prompt remediation.

Risk score, explained

The CVSS 3.1 score of 7.7 reflects HIGH severity with High impact on Confidentiality and Integrity, low Attack Vector (Local), low Attack Complexity, and no privileges required. The vulnerability directly compromises the filesystem's ability to enforce access controls and privilege separation, affecting the confidentiality of file operations visible to the wrong user ID and the integrity of filesystem operations that should only be executable by privileged callers. The Local-only attack vector and lack of a network component prevent a score above 8.0, but the fundamental breakdown of privilege isolation justifies the 7.7 rating.

Frequently asked questions