CVE-2026-52906

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> 9p: fix access mode flags being ORed instead of replaced<br /> <br /> Since commit 1f3e4142c0eb ("9p: convert to the new mount API"),<br /> v9fs_apply_options() applies parsed mount flags with |= onto flags<br /> already set by v9fs_session_init(). For 9P2000.L, session_init sets<br /> V9FS_ACCESS_CLIENT as the default, so when the user mounts with<br /> "access=user", both bits end up set. Access mode checks compare<br /> against exact values, so having both bits set matches neither mode.<br /> <br /> This causes v9fs_fid_lookup() to fall through to the default switch<br /> case, using INVALID_UID (nobody/65534) instead of current_fsuid()<br /> for all fid lookups. Root is then unable to chown or perform other<br /> privileged operations.<br /> <br /> Fix by clearing the access mask before applying the user&amp;#39;s choice.