Skip to main content

Linux Kernel CVE-2026-63800

| EUVDEUVD-2026-45466 CRITICAL
Use After Free (CWE-416)
2026-07-19 Linux GHSA-fjxq-h4gg-vf5r
Information Disclosure Linux Use After Free Memory Corruption
Critical
Disputed · 9.8 Vendor: Linux
Share

Severity by source

Sources disagree (Medium–Critical)
Vendor (Linux) PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
5.3 MEDIUM

Client-side race in pNFS layout handling needs local access and specific timing (AV:L/AC:H/PR:L); impact is mainly a kernel crash (A:H) with limited freed-memory disclosure (C:L).

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
7.0 HIGH
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Red Hat
7.0 MEDIUM
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 20, 2026 - 15:32 vuln.today
CVSS changed
Jul 20, 2026 - 15:22 NVD
9.8 (CRITICAL)
Patch available
Jul 19, 2026 - 14:17 EUVD
CVE Published
Jul 19, 2026 - 12:02 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 19, 2026 - 12:02 cve.org
CRITICAL 9.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

pNFS: Fix use-after-free in pnfs_update_layout()

When hitting the NFS_LAYOUT_RETURN branch in pnfs_update_layout(), the code calls pnfs_prepare_to_retry_layoutget(lo). If it succeeds, pnfs_put_layout_hdr(lo) is called before trace_pnfs_update_layout(), which still references 'lo'. This results in a use-after-free when the tracepoint accesses lo's fields.

Fix this by moving the tracepoint call before pnfs_put_layout_hdr(lo).

AnalysisAI

Use-after-free in the Linux kernel pNFS (parallel NFS) client, specifically in pnfs_update_layout(), lets a stale layout header (lo) be read by a tracepoint after pnfs_put_layout_hdr() has already freed it when execution takes the NFS_LAYOUT_RETURN branch. The flaw affects Linux NFS clients that mount pNFS-backed exports across a wide range of stable series (5.4.x, 5.10.x, 5.15.x, 6.1.x, 6.6.x, 6.12.x, 6.18.x and 7.x-rc). There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the tags label it Information Disclosure, consistent with a tracepoint reading freed memory. The published CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N) appears inflated for what is a client-side, race-dependent memory-safety bug.

Technical ContextAI

The vulnerability lives in the kernel's pNFS layout management code (fs/nfs/pnfs.c). pnfs_update_layout() manages NFSv4.1+ layout handles referenced through a reference-counted layout header structure (pnfs_layout_hdr, 'lo'). When the code hits the NFS_LAYOUT_RETURN branch it calls pnfs_prepare_to_retry_layoutget(lo), and on success drops its reference via pnfs_put_layout_hdr(lo) - which can free the object - before trace_pnfs_update_layout() runs. The tracepoint then dereferences fields of the freed 'lo', a classic CWE-416 Use-After-Free (the input lists CWE as N/A, but the description of accessing freed 'lo' fields places it squarely in CWE-416). The fix reorders the code so the tracepoint fires before the reference is dropped. The CPE data (cpe:2.3:a:linux:linux:*) only identifies the Linux kernel generically without pinning versions, so exact boundaries must be read from the git.kernel.org stable commits.

RemediationAI

Apply the vendor-released stable patches: upgrade to your series' fixed build - 5.10.260, 5.15.211, 6.1.177, 6.6.144, 6.12.95, 6.18.38, 7.1.3, or 7.2-rc1 or later - using the distribution kernel that incorporates the fix commits at git.kernel.org (e.g. https://git.kernel.org/stable/c/7e37e9b3e82ade881e1798e2f4fcc54aff7793c1 and the parallel 4ad8b9a8, 1f24b830, 9c0fb5c0, 2883ddd7, 200e7637, 9645aaf6, 13e198a9 commits). Because the trigger is confined to the pNFS client tracepoint path, an effective compensating control until reboot is to avoid mounting pNFS-backed NFS exports (use non-pNFS mounts) and to leave the NFS pnfs_update_layout tracepoint disabled, which prevents the freed 'lo' from being read; the trade-off is loss of pNFS parallel I/O performance and reduced NFS tracing visibility for debugging. Restricting local access and normal kernel-livepatch workflows further reduce exposure. Follow your distribution's advisory tracker for the backported package version.

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-63800 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy