CVE-2026-52906: 9p: fix access mode flags being ORed instead of replaced

Synopsis

A privilege mismatch bug in the Linux kernel's 9P filesystem client causes access mode flags to be combined with a bitwise OR instead of being replaced, corrupting the effective access mode for mounted 9P filesystems. The vulnerability is reachable locally without any authentication, because any user who can invoke a mount operation triggers the broken flag logic. Successful exploitation lets an attacker read and modify files they should not have access to on the affected 9P mount, because fid lookups fall back to INVALID_UID rather than the caller's real user ID. A patched-image rebuild at the fix versions is available on HarborGuard for environments running an affected kernel version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access to the target is required.

• AuthenticationNot required

  No credentials are required; any local user capable of triggering a 9P mount operation is sufficient to reach the vulnerable code path.

• Victim interactionNot required

  No action from another user or administrator is needed; the attacker exercises the vulnerability independently.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race condition, specific memory layout, or environmental dependency is required to trigger the flag corruption.

Blast Radius

• An attacker reads files and directory contents on the affected 9P mount that the filesystem would otherwise restrict to other users or to root.
• An attacker writes or modifies files on the 9P mount beyond their actual permission level, because fid lookups resolve to INVALID_UID instead of the caller's real user ID.
• Privileged operations such as chown are denied to root, disrupting administrative control over the mounted filesystem and any workloads depending on correct ownership semantics.