CVE-2026-52906: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-52906 is an incorrect privilege assignment vulnerability (CWE-266) in the Linux kernel's 9P filesystem implementation, where access mode flags are incorrectly ORed together instead of being replaced during mount option processing. Since commit 1f3e4142c0eb ("9p: convert to the new mount API"), v9fs_apply_options() applies parsed mount flags with |= onto flags already set by v9fs_session_init(), causing both the default V9FS_ACCESS_CLIENT bit and the user-specified access mode bit to be set simultaneously. This results in v9fs_fid_lookup() falling through to the default switch case and using INVALID_UID (nobody/65534) instead of the current user's UID for all file ID lookups. The vulnerability affects Linux kernel versions from commit 1f3e4142c0eb up to the patched commits, with fixes available in stable branches. It carries a CVSS v3.1 base score of 7.7 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is a logic error (CWE-266: Incorrect Privilege Assignment) introduced when the 9P filesystem driver was converted to the new Linux mount API. In v9fs_apply_options(), the |= operator is used to apply user-specified mount flags, which means the default V9FS_ACCESS_CLIENT flag set by v9fs_session_init() is never cleared before the user's choice is applied. For 9P2000.L mounts using access=user, both V9FS_ACCESS_CLIENT and V9FS_ACCESS_USER bits end up set simultaneously. Because access mode checks in v9fs_fid_lookup() compare against exact bitmask values, the combined value matches no valid mode, causing the function to fall through to the default case and substitute INVALID_UID (UID 65534/nobody) for all file ID lookups. The fix clears the access mask before applying the user's specified mode, ensuring flags are replaced rather than accumulated (GitHub Advisory, Red Hat Bugzilla).

Successful triggering of this vulnerability causes the 9P filesystem to use INVALID_UID (nobody/UID 65534) for all file ID lookups instead of the actual user's UID, effectively breaking permission enforcement on mounted 9P filesystems. The root user is unable to perform privileged operations such as chown or other ownership-related tasks, and access controls are bypassed in a way that misrepresents user identity to the filesystem. This affects confidentiality and integrity — unauthorized users may access or modify files they should not be able to, while legitimate privileged users are denied expected access — though availability is not directly impacted (GitHub Advisory, Feedly).

The fix is available in the Linux kernel stable tree via two patch commits: b8f037e87a083291190204b959cda417aaf01058 and da2346a48a5a1fed86c3fe3d73c0b60e7b3027c9, which clear the access mask before applying the user's specified mode in v9fs_apply_options(). Users should update to a patched kernel version (patch targets include Linux 7.0.4 and 7.1-rc1 stable branches). As a temporary workaround, avoid mounting 9P filesystems with custom access= mount options until the kernel is updated (GitHub Advisory, Red Hat Bugzilla).

Red Hat has tracked this vulnerability via their Bugzilla system (Bug 2486998) and the upstream kernel CVE announcement was published via the linux-cve-announce mailing list. OpenSUSE has also issued a security announcement addressing this CVE. No significant broader media coverage or notable researcher commentary has been identified beyond standard vulnerability tracking (Red Hat Bugzilla).