CVEvulnerability

CVE-2026-63800

9.8 CRITICAL Published 2026-07-19 Modified 2026-10-19 Official page ↗
Status
Modified
Published
2026-07-19
Last modified
2026-10-19
Assigner
416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS 3.1 (416baaa9-dc9f-4396-8d5f-8c081fb06d67)
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-416

Description

In the Linux kernel, the following vulnerability has been resolved: pNFS: Fix use-after-free in pnfs_update_layout() When hitting the NFS_LAYOUT_RETURN branch in pnfs_update_layout(), the code calls pnfs_prepare_to_retry_layoutget(lo). If it succeeds, pnfs_put_layout_hdr(lo) is called before trace_pnfs_update_layout(), which still references 'lo'. This results in a use-after-free when the tracepoint accesses lo's fields. Fix this by moving the tracepoint call before pnfs_put_layout_hdr(lo).

Affected configurations

• linux linux kernel (>= 5.4.91 < 5.5) • linux linux kernel (>= 5.10.9 < 5.10.260) • linux linux kernel (>= 5.11.1 < 5.15.211) • linux linux kernel (>= 5.16 < 6.1.177) • linux linux kernel (>= 6.2 < 6.6.144) • linux linux kernel (>= 6.7 < 6.12.95) • linux linux kernel (>= 6.13 < 6.18.38) • linux linux kernel (>= 6.19 < 7.1.3) • linux linux kernel 5.11

Related

Weakness · CWE (1)

References