Windows Subsystem for Linux 2.7.12 lands stable with fixes for plugin mounts and VHD ownership
Targeted patches address permission errors in guest VMs and cross-volume distribution move headaches.
Microsoft pushed WSL 2.7.12 to the stable channel on August 18, 2026. You can grab it now via wsl --update. The release is tight. Targeted. Exactly what you want in a stable patch.
Two fixes land in the 2.7.x branch: one resolves permission errors when plugins mount host folders into your Linux VM, and the other closes the long-running loop on VHD ownership during cross-volume distribution moves, which previously left disk images locked behind BUILTIN\Administrators.
Both patches ship on the stable branch, so you get them without opting into a pre-release channel.
Plugin mounts now respect your user token
If you rely on Docker Desktop, VS Code Remote, or other WSL-integrated tooling, you've likely hit this wall. You'd mount a folder from Windows into Linux, only to find the permissions pointed at the elevated service account running the WSL daemon rather than your own SID. The result was access denied errors when you tried to write to your own data.
PR #41331 by @OneBlue swaps the elevated service token for your actual user token when calling AddPlan9Share. Now, when a plugin mounts a host folder, the permissions inside the guest align with your session. A regression test confirms writes succeed without jumping through permission hoops.
Next, the VHD ownership fix. The 2.7.x release history has read like a rolling battle against this exact issue. You had fixes in April, May, June, July, and now August. Every time the team patched one edge case, another surfaced.
PR #41354 by @benhillis takes a cleaner approach this time. It's a backport of the master branch fix, but it resolves the core logic cleanly. When wsl --move triggers MoveFileExW across volumes, the API performs a copy-and-delete. The new file used to inherit the default owner from the impersonation token, which usually meant BUILTIN\Administrators.
The fix duplicates the caller's token, sets the default owner to your user SID, and runs the move under that context. Rollback paths are handled too. If you're moving a distribution and something goes wrong, the source VHD keeps its original owner.
Clean work. The need for manual icacls commands after a cross-volume move should be a thing of the past.
What's in and out of scope
The 2.7.x branch is locked to bug fixes and security backports. You won't find new features here. The bleeding edge is on 2.9.x, where WSL Containers has hit public preview. However, at the same time, the WSL team is clearly prioritizing stability hardening for the stable track. The aggressive backlog of VHD and permission issues suggests a concerted effort to clean up the migration and integration surface before the next major feature push.
@OneBlue tagged the release, and @benhillis approved the backport. Both are on the core team. Keep in mind that the repository still has 909 open issues, though the VHD thread seems to be winding down.
How to update
Head here to download the manual installer if you prefer that route. Otherwise, wsl --update in PowerShell will grab the bits. Store-installed instances will get pushed the update automatically.
If you're running 2.7.x, you should probably just update. The plugin mount fix saves you headaches with Docker and VS Code, and the VHD patch finally closes the door on cross-volume move errors.
