CVE-2026-63795
Received Received - Intake

Reference Leak in Linux Kernel 9p Filesystem

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: 9p: avoid putting oldfid in p9_client_walk() error path When p9_client_walk() is called with clone set to false, fid aliases oldfid. If the walk subsequently fails after the request has been sent, the error path jumps to clunk_fid, which currently calls p9_fid_put(fid) unconditionally. This drops a reference to oldfid even though ownership of oldfid remains with the caller. If this is the last reference, oldfid can be clunked and destroyed while the caller still expects it to be valid. A later use or put of oldfid can then trigger a use-after-free or refcount underflow. Fix this by only putting fid in the clunk_fid error path when it does not alias oldfid, matching the existing guard in the error path below. This can be triggered when a multi-component walk is split into multiple p9_client_walk() calls and a later non-cloning walk fails. A reproducer and refcount warning logs are available on request.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-63795
EUVD
EUVD-2026-45461

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a use-after-free vulnerability in the Linux kernel's 9p filesystem implementation. It occurs when p9_client_walk() fails after sending a request. The error path incorrectly drops a reference to oldfid even though the caller still owns it. This can lead to oldfid being destroyed while still in use, causing a use-after-free or refcount underflow when accessed later.

Detection Guidance

This vulnerability is specific to the Linux kernel's 9p filesystem implementation and may not have direct network detection methods. Check kernel logs for refcount warnings or use-after-free errors related to 9p or fid handling. Commands like dmesg | grep -i 'refcount' or dmesg | grep -i 'use-after-free' may help identify issues.

Impact Analysis

If exploited, this could allow an attacker to crash the system or execute arbitrary code with kernel privileges. It may lead to data corruption, denial of service, or privilege escalation on systems using the 9p filesystem.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a low-level kernel memory management issue unrelated to data protection or privacy controls.

Mitigation Strategies

Apply the latest kernel patches or updates that include the fix for this issue. If immediate patching is not possible, consider disabling the 9p filesystem module if not in use. Monitor kernel logs for related errors as a sign of exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63795. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart