The vulnerability arises in the Linux kernel’s 9P filesystem when mount options are combined incorrectly. Access mode flags are ORed rather than replaced, so when a user mounts with "access=user" both the default client bit and the user bit become set. Because access checks require an exact match, neither mode is recognized, causing the system to fall back to an invalid user ID for all file ID lookups. As a result, root is unable to perform privileged operations such as chown or other activities that require root privileges. The flaw does not grant additional privileges to an attacker, but it breaks normal root functionality and can disrupt system administration.

All Linux kernel deployments that have not yet incorporated the repository commit 1f3e4142c0eb and the subsequent fix commit. Systems running older kernel versions that support 9P mounts and may use the "access=user" option are affected.

The issue causes a denial of privileged operations for root but does not provide a direct attack path for privilege escalation or data compromise. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is likely local, requiring the ability to mount a 9P filesystem with specific options. Because the flaw does not enable an attacker to gain elevated privileges or exfiltrate data, the overall risk to the system is low to moderate, primarily impacting root administrative work.