Skip to main content

Linux Kernel EUVDEUVD-2026-45461

| CVE-2026-63795 CRITICAL
Use After Free (CWE-416)
2026-07-19 Linux GHSA-jj7f-gfpp-fxfg
Information Disclosure Linux Use After Free Memory Corruption
10.0
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
10.0 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
vuln.today AI
7.0 HIGH

Requires a local 9p mount and a race-like failed non-cloning walk, so AV:L/AC:H/PR:L; kernel UAF can yield memory corruption enabling full local impact, hence C/I/A:H.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Red Hat
7.0 HIGH
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 20, 2026 - 15:29 vuln.today
CVSS changed
Jul 20, 2026 - 15:22 NVD
10.0 (CRITICAL)
Patch available
Jul 19, 2026 - 14:17 EUVD
CVE Published
Jul 19, 2026 - 12:02 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 19, 2026 - 12:02 cve.org
CRITICAL 10.0

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

9p: avoid putting oldfid in p9_client_walk() error path

When p9_client_walk() is called with clone set to false, fid aliases oldfid. If the walk subsequently fails after the request has been sent, the error path jumps to clunk_fid, which currently calls p9_fid_put(fid) unconditionally.

This drops a reference to oldfid even though ownership of oldfid remains with the caller. If this is the last reference, oldfid can be clunked and destroyed while the caller still expects it to be valid. A later use or put of oldfid can then trigger a use-after-free or refcount underflow.

Fix this by only putting fid in the clunk_fid error path when it does not alias oldfid, matching the existing guard in the error path below.

This can be triggered when a multi-component walk is split into multiple p9_client_walk() calls and a later non-cloning walk fails. A reproducer and refcount warning logs are available on request.

AnalysisAI

Use-after-free and refcount underflow in the Linux kernel's 9p (Plan 9) filesystem client allows a local attacker interacting with a 9p mount to corrupt kernel memory, potentially escalating privileges or crashing the system. The flaw lives in p9_client_walk(): when called with clone=false the new fid aliases oldfid, and a failed multi-component walk incorrectly drops oldfid's reference via the clunk_fid error path, freeing a fid the caller still holds. No public exploit is identified at time of analysis (a reproducer exists only 'on request'), and it is not listed in CISA KEV; the vendor-supplied CVSS of 10.0 appears substantially overstated for a bug requiring an active 9p mount.

Technical ContextAI

The 9p protocol is a lightweight network filesystem originally from Plan 9, used in Linux primarily for host/guest directory sharing in virtualization (virtio-9p in QEMU/KVM, WSL-style setups) and for connecting to remote 9p file servers. The kernel client tracks each open file object with a reference-counted 'fid' structure. p9_client_walk() traverses path components; when invoked with clone=false it reuses the caller's oldfid rather than allocating a new one, so the returned fid pointer aliases oldfid. The bug is a classic CWE-416 use-after-free stemming from a reference-counting error (CWE-672/CWE-911): the clunk_fid error path called p9_fid_put(fid) unconditionally, dropping a reference that logically belonged to the caller's oldfid. When that reference was the last, the fid was clunked and freed while still in use. The CPE data (cpe:2.3:a:linux:linux) confirms the affected product is the mainline Linux kernel; the fix adds a guard so fid is only put when it does not alias oldfid, mirroring an existing guard further down the same function.

RemediationAI

Vendor-released patch: upgrade to a fixed stable kernel - 6.1.177, 6.6.144, 6.12.95, 6.18.38, or 7.1.3 (fix landed in mainline 7.2-rc1). The specific commits are available at https://git.kernel.org/stable/c/99c379ca1e221c3d75c7c804ebbf4e5ee37a3070 and the sibling stable backports (b84f46179c80, a61bdcba4f64, 6dbe9443d9f5, a7656d368265, 1a3860d46e3e); apply the update your distribution ships that includes these. If immediate patching is not possible, the most effective compensating control is to avoid the vulnerable code path: do not mount 9p filesystems and unload/blacklist the 9p and 9pnet modules (modprobe blacklist 9p, 9pnet, 9pnet_virtio) on hosts that do not need them - the trade-off is loss of virtio-9p host/guest directory sharing in affected VMs. Where 9p sharing is required, restrict which 9p servers guests connect to and treat only trusted servers, since a misbehaving or malicious 9p server can drive the failing walk sequence.

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

EUVD-2026-45461 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy