In the Linux kernel, the following vulnerability has been resolved:
9p: fix access mode flags being ORed instead of replaced
Since commit 1f3e4142c0eb ("9p: convert to the new mount API"), v9fs_apply_options() applies parsed mount flags with |= onto flags already set by v9fs_session_init(). For 9P2000.L, session_init sets V9FS_ACCESS_CLIENT as the default, so when the user mounts with "access=user", both bits end up set. Access mode checks compare against exact values, so having both bits set matches neither mode.
This causes v9fs_fid_lookup() to fall through to the default switch case, using INVALID_UID (nobody/65534) instead of current_fsuid() for all fid lookups. Root is then unable to chown or perform other privileged operations.
Fix by clearing the access mask before applying the user's choice.
CVSS Details
- CVSS 3.1 Base Score: 7.7
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Ubuntu | — | Upgrade linux-image-gcpUpgrade linux-image-generic-hwe-26.04Upgrade linux-image-raspi-7.0Upgrade linux-image-realtime-64k-hwe-26.04Upgrade linux-image-raspi-realtime-7.0Upgrade linux-image-realtime-64k-7.0Upgrade linux-image-7.0.0-28-genericUpgrade linux-image-7.0.0-1007-oracleUpgrade linux-image-awsUpgrade linux-image-realtimeUpgrade linux-image-aws-64kUpgrade linux-image-7.0.0-1008-oemUpgrade linux-image-7.0.0-27-realtime-64kUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-oem-26.04aUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-oem-7.0Upgrade linux-image-7.0.0-27-realtimeUpgrade linux-image-virtual-7.0Upgrade linux-image-oem-24.04aUpgrade linux-image-raspi-realtimeUpgrade linux-image-realtime-64kUpgrade linux-image-7.0.0-27-genericUpgrade linux-image-7.0.0-1014-raspi-realtimeUpgrade linux-image-azure-7.0Upgrade linux-image-7.0.0-1008-awsUpgrade linux-image-oracleUpgrade linux-image-gcp-64kUpgrade linux-image-oracle-64kUpgrade linux-image-oem-24.04cUpgrade linux-image-gcp-64k-7.0Upgrade linux-image-oem-24.04dUpgrade linux-image-nvidia-64kUpgrade linux-image-generic-7.0Upgrade linux-image-raspiUpgrade linux-image-gcp-7.0Upgrade linux-image-aws-64k-7.0Upgrade linux-image-ibmUpgrade linux-image-7.0.0-1013-nvidiaUpgrade linux-image-7.0.0-1009-azure-fdeUpgrade linux-image-7.0.0-1010-azureUpgrade linux-image-azure-fde-7.0Upgrade linux-image-nvidiaUpgrade linux-image-7.0.0-1009-ibmUpgrade linux-image-generic-64k-hwe-26.04Upgrade linux-image-7.0.0-1007-gcpUpgrade linux-image-azureUpgrade linux-image-7.0.0-1007-gcp-64kUpgrade linux-image-realtime-7.0Upgrade linux-image-oracle-64k-7.0Upgrade linux-image-oem-24.04bUpgrade linux-image-oem-24.04Upgrade linux-image-oracle-7.0Upgrade linux-image-nvidia-64k-7.0Upgrade linux-image-generic-64kUpgrade linux-image-7.0.0-1008-aws-64kUpgrade linux-image-realtime-hwe-26.04Upgrade linux-image-7.0.0-27-generic-64kUpgrade linux-image-oem-26.04Upgrade linux-image-virtual-hwe-26.04Upgrade linux-image-7.0.0-1013-nvidia-64kUpgrade linux-image-azure-fdeUpgrade linux-image-aws-7.0Upgrade linux-image-generic-64k-7.0Upgrade linux-image-7.0.0-28-generic-64kUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-virtualUpgrade linux-image-genericUpgrade linux-image-7.0.0-1014-raspiUpgrade linux-image-ibm-7.0Upgrade linux-image-nvidia-7.0Upgrade linux-image-7.0.0-1007-oracle-64k | Jul 1, 2026 | Jun 9, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub