CVE-2026-63800

Awaiting Analysis Awaiting Analysis - Queue

Use-After-Free in Linux Kernel pNFS

Publication date: 2026-07-19

Last updated on: 2026-07-29

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: pNFS: Fix use-after-free in pnfs_update_layout() When hitting the NFS_LAYOUT_RETURN branch in pnfs_update_layout(), the code calls pnfs_prepare_to_retry_layoutget(lo). If it succeeds, pnfs_put_layout_hdr(lo) is called before trace_pnfs_update_layout(), which still references 'lo'. This results in a use-after-free when the tracepoint accesses lo's fields. Fix this by moving the tracepoint call before pnfs_put_layout_hdr(lo).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-19

Last Modified

2026-07-29

Generated

2026-08-09

AI Q&A

2026-07-19

EPSS Evaluated

2026-08-08

NVD

CVE-2026-63800

EUVD

EUVD-2026-45466

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	5.11
linux	linux_kernel	5.11
linux	linux_kernel	5.11
linux	linux_kernel	5.11
linux	linux_kernel	5.11
linux	linux_kernel	From 5.4.91 (inc) to 5.5 (exc)
linux	linux_kernel	From 5.16 (inc) to 6.1.177 (exc)
linux	linux_kernel	From 6.2 (inc) to 6.6.144 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.95 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.38 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.1.3 (exc)
linux	linux_kernel	From 5.10.9 (inc) to 5.10.260 (exc)
linux	linux_kernel	From 5.11.1 (inc) to 5.15.211 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This is a use-after-free vulnerability in the Linux kernel's pNFS (Parallel NFS) implementation. It occurs in the pnfs_update_layout function when handling the NFS_LAYOUT_RETURN branch. The issue arises because a tracepoint still references a freed memory object after it has been released by pnfs_put_layout_hdr.

Detection Guidance

This vulnerability is specific to the Linux kernel's pNFS implementation and requires kernel-level detection. Monitor kernel logs for NFS-related errors or crashes. Check for tracepoint-related warnings in /var/log/kern.log or dmesg output. No direct network detection commands are applicable.

Impact Analysis

This vulnerability could allow an attacker to cause a system crash or potentially execute arbitrary code with kernel privileges. It may lead to denial-of-service conditions or unauthorized access if exploited.

Compliance Impact

This vulnerability is a use-after-free issue in the Linux kernel's pNFS component, which could lead to memory corruption or crashes. It does not directly affect compliance with standards like GDPR or HIPAA, as those focus on data protection and privacy rather than kernel memory management.

Mitigation Strategies

Apply the latest Linux kernel update that includes the fix for CVE-2026-63800. If immediate patching is not possible, disable pNFS functionality by unmounting NFS shares or disabling the pnfs module. Monitor system stability after applying changes.

Hi! I’m here to help you understand CVE-2026-63800. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70