CVE-2026-52906

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-52906", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-06-09T07:44:35.366Z", "datePublished": "2026-06-09T12:36:03.521Z", "dateUpdated": "2026-08-05T12:31:29.381Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:31:29.381Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\n9p: fix access mode flags being ORed instead of replaced\n\nSince commit 1f3e4142c0eb (\"9p: convert to the new mount API\"),\nv9fs_apply_options() applies parsed mount flags with |= onto flags\nalready set by v9fs_session_init(). For 9P2000.L, session_init sets\nV9FS_ACCESS_CLIENT as the default, so when the user mounts with\n\"access=user\", both bits end up set. Access mode checks compare\nagainst exact values, so having both bits set matches neither mode.\n\nThis causes v9fs_fid_lookup() to fall through to the default switch\ncase, using INVALID_UID (nobody/65534) instead of current_fsuid()\nfor all fid lookups. Root is then unable to chown or perform other\nprivileged operations.\n\nFix by clearing the access mask before applying the user's choice."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "baseScore": 7.7, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The flaw is reached through local mount and VFS file-operation syscalls (open, read, write, setattr) on a 9p client mount, not through remote packet handling. Even when 9p uses virtio or TCP transport, exploitation requires local access to the mounted filesystem or local CAP_SYS_ADMIN to mount with the triggering options.\nAC:L - An attacker who can mount 9p with 9P2000.L and `access=user` or `access=<uid>` reliably triggers the bug on every fid lookup. On systems where virtio-9p is already mounted with those options, exploitation requires only normal filesystem access with no race or special timing.\nPR:N - Exploitation against an already-mounted vulnerable 9p share requires no elevated privileges\u2014only local shell access to the mount point. The worst case (`access=<uid>` SINGLE mode) is meant to block all other users, yet any unprivileged local user can still obtain fids and access the share.\nUI:N - Once a vulnerable 9p filesystem is mounted, no further victim interaction is required; the attacker simply performs normal file operations. Mounting with the triggering options is attacker-controlled or a one-time administrative setup, not ongoing user interaction at exploitation time.\nS:U - Impact is confined to unauthorized access within the guest/kernel filesystem boundary (bypassing 9p access-mode isolation between local users or against a single-user mount restriction). It does not cross VM-to-host, IOMMU, or sandbox security boundaries beyond the shared 9p export itself.\nC:H - The mangled access mask forces all operations through a shared INVALID_UID attach instead of per-user attaches, breaking confidentiality guarantees of `access=user` and completely defeating `access=<uid>` SINGLE-mode isolation. Unprivileged users can read data on mounts explicitly restricted to another user.\nI:H - The same fid-lookup failure lets unauthorized users perform writes through the shared INVALID_UID attach on mounts where SINGLE or per-user modes should have prevented any access. Server-side authorization keyed to attach identity is undermined, enabling unauthorized modification of files on the export.\nA:N - The bug is a logic error in access-mode handling that misroutes fid lookups; it does not cause kernel oops, panic, hang, or repeatable denial of service. Root losing chown capability on the mount is a localized authorization failure, not system-wide availability loss."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/9p/v9fs.c"], "versions": [{"version": "1f3e4142c0eb178089ea0cbc97506a061470ad27", "lessThan": "b8f037e87a083291190204b959cda417aaf01058", "status": "affected", "versionType": "git"}, {"version": "1f3e4142c0eb178089ea0cbc97506a061470ad27", "lessThan": "da2346a48a5a1fed86c3fe3d73c0b60e7b3027c9", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/9p/v9fs.c"], "versions": [{"version": "6.19", "status": "affected"}, {"version": "0", "lessThan": "6.19", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.4", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "7.0.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "7.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/b8f037e87a083291190204b959cda417aaf01058"}, {"url": "https://git.kernel.org/stable/c/da2346a48a5a1fed86c3fe3d73c0b60e7b3027c9"}], "title": "9p: fix access mode flags being ORed instead of replaced", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/9p/v9fs.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "b8f037e87a083291190204b959cda417aaf01058", "status": "affected", "version": "1f3e4142c0eb178089ea0cbc97506a061470ad27", "versionType": "git"}, {"lessThan": "da2346a48a5a1fed86c3fe3d73c0b60e7b3027c9", "status": "affected", "version": "1f3e4142c0eb178089ea0cbc97506a061470ad27", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/9p/v9fs.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.19"}, {"lessThan": "6.19", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "7.0.*", "status": "unaffected", "version": "7.0.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "CDB78D6D-22C3-4154-B0D0-94AF1CE5C2E3", "versionEndExcluding": "7.0.4", "versionStartIncluding": "6.19", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\n9p: fix access mode flags being ORed instead of replaced\n\nSince commit 1f3e4142c0eb (\"9p: convert to the new mount API\"),\nv9fs_apply_options() applies parsed mount flags with |= onto flags\nalready set by v9fs_session_init(). For 9P2000.L, session_init sets\nV9FS_ACCESS_CLIENT as the default, so when the user mounts with\n\"access=user\", both bits end up set. Access mode checks compare\nagainst exact values, so having both bits set matches neither mode.\n\nThis causes v9fs_fid_lookup() to fall through to the default switch\ncase, using INVALID_UID (nobody/65534) instead of current_fsuid()\nfor all fid lookups. Root is then unable to chown or perform other\nprivileged operations.\n\nFix by clearing the access mask before applying the user's choice."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\n9p: corrige que los indicadores de modo de acceso se combinen con OR en lugar de ser reemplazados\n\nDesde el commit 1f3e4142c0eb ('9p: convertir a la nueva API de montaje'),\nv9fs_apply_options() aplica los indicadores de montaje analizados con |= sobre los indicadores ya establecidos por v9fs_session_init(). Para 9P2000.L, session_init establece V9FS_ACCESS_CLIENT como predeterminado, as\u00ed que cuando el usuario monta con 'access=user', ambos bits terminan establecidos. Las comprobaciones de modo de acceso comparan con valores exactos, as\u00ed que tener ambos bits establecidos no coincide con ninguno de los modos.\n\nEsto hace que v9fs_fid_lookup() caiga al caso predeterminado del switch, usando INVALID_UID (nobody/65534) en lugar de current_fsuid() para todas las b\u00fasquedas de fid. Root es entonces incapaz de chown o realizar otras operaciones privilegiadas.\n\nSe corrige limpiando la m\u00e1scara de acceso antes de aplicar la elecci\u00f3n del usuario."}], "id": "CVE-2026-52906", "lastModified": "2026-07-23T08:10:00.137", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 5.2, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-06-09T14:16:45.047", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b8f037e87a083291190204b959cda417aaf01058"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/da2346a48a5a1fed86c3fe3d73c0b60e7b3027c9"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: 9p: fix access mode flags being ORed instead of replaced", "id": "2486998", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2486998"}, "csaw": false, "cwe": "CWE-266", "details": ["A flaw was found in the Linux kernel's 9p filesystem. When mounting, access mode flags were incorrectly combined instead of being replaced, leading to an invalid configuration. This issue causes root users to be unable to perform privileged operations like changing file ownership, effectively degrading their privileges and causing a denial of service for these specific actions."], "name": "CVE-2026-52906", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-06-09T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-52906\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-52906\nhttps://lore.kernel.org/linux-cve-announce/2026060913-CVE-2026-52906-4464@gregkh/T"]}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1f3e4142c0eb178089ea0cbc97506a061470ad27,b8f037e87a083291190204b959cda417aaf01058)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1f3e4142c0eb178089ea0cbc97506a061470ad27,da2346a48a5a1fed86c3fe3d73c0b60e7b3027c9)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.19"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.19)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0.4,8.0.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-06-09T15:00:07.484592+00:00", "updated": "2026-08-13T23:30:03.025109+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}