Executive brief
A vulnerability in the Linux kernel's 9p file system protocol can cause administrative users to lose their privileges when performing file operations. When specific mount options are used, the system fails to correctly identify the user's identity, defaulting to a 'nobody' account with no permissions. This prevents the root user from performing essential tasks like changing file ownership or other privileged administrative operations.
Technical details
A logic error in v9fs_apply_options() causes mount flags to be ORed instead of replaced when using the new mount API. In 9P2000.L, if a user specifies 'access=user', the V9FS_ACCESS_USER bit is ORed with the default V9FS_ACCESS_CLIENT bit. Because the kernel performs exact value comparisons for access modes, this bitwise combination matches no valid mode. Consequently, v9fs_fid_lookup() falls through to a default case that uses INVALID_UID (65534) for all lookups, preventing the root user from performing privileged operations like chown. The fix involves clearing the V9FS_ACCESS_MASK before applying new session options.
Affected products
- Linux Linux Kernel from 1f3e4142c0eb
Timeline
- 2026-04-02: other: Patch authored
- 2026-06-09: disclosed: CVE published