Linux Kernel up to 7.0.3 9p v9fs_apply_options comparison

Summaryinfo

A vulnerability was found in Linux Kernel up to 7.0.3. It has been rated as critical. The affected element is the function v9fs_apply_options of the component 9p. The manipulation leads to comparison. This vulnerability is documented as CVE-2026-52906. There is not any exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Linux Kernel up to 7.0.3. This issue affects the function v9fs_apply_options of the component 9p. The manipulation with an unknown input leads to a comparison vulnerability. Using CWE to declare the problem leads to CWE-697. The product compares two entities in a security-relevant context, but the comparison is incorrect, which may lead to resultant weaknesses. The impact remains unknown. The summary by CVE is:

In the Linux kernel, the following vulnerability has been resolved: 9p: fix access mode flags being ORed instead of replaced Since commit 1f3e4142c0eb ("9p: convert to the new mount API"), v9fs_apply_options() applies parsed mount flags with |= onto flags already set by v9fs_session_init(). For 9P2000.L, session_init sets V9FS_ACCESS_CLIENT as the default, so when the user mounts with "access=user", both bits end up set. Access mode checks compare against exact values, so having both bits set matches neither mode. This causes v9fs_fid_lookup() to fall through to the default switch case, using INVALID_UID (nobody/65534) instead of current_fsuid() for all fid lookups. Root is then unable to chown or perform other privileged operations. Fix by clearing the access mask before applying the user's choice.

It is possible to read the advisory at git.kernel.org. The identification of this vulnerability is CVE-2026-52906 since 06/09/2026. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 06/10/2026).

Upgrading to version 7.0.4 or 7.1-rc1 eliminates this vulnerability. Applying the patch b8f037e87a083291190204b959cda417aaf01058/da2346a48a5a1fed86c3fe3d73c0b60e7b3027c9 is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at CERT Bund (WID-SEC-2026-1870). Be aware that VulDB is the high quality source for vulnerability data.

Affected

• Open Source Linux Kernel

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 7.0.0
• 7.0.1
• 7.0.2
• 7.0.3

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion