In the Linux kernel’s 9P filesystem, a bug causes access mode flags to be ORed rather than replaced when mount options are parsed. If the default client access mode is set and a user mounts with "access=user", both bits become active. Access checks require an exact match, so neither mode is recognized and the system falls back to an invalid user ID (65534, the "nobody" user) for all file identifier lookups. As a result, the root user loses the ability to perform privileged operations such as chown or other administration commands that depend on root privileges. The flaw does not grant additional privileges to an attacker; it simply blocks normal root functionality.

All Linux kernel deployments that have not yet integrated the commit that fixed this issue (the change that clears the access mask before applying user‑specified flags). Systems running older kernels that support 9P mounts and may use the "access=user" option are affected. Any host that mounts a 9P filesystem with this option is potentially impacted until the kernel patch is applied.

The vulnerability results in a denial of privileged operations for the root account but does not provide a path to privilege escalation or data exfiltration. The CVSS score of 7.7 indicates high severity, while an EPSS score of < 1% suggests a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Likely attack vectors are local, requiring an attacker who can mount a 9P filesystem with specific options, which most administrators already control. Overall risk is low to moderate, primarily affecting root administrative capabilities.