CVE-2026-63795
9p: avoid putting oldfid in p9_client_walk() error path
Description
In the Linux kernel, the following vulnerability has been resolved: 9p: avoid putting oldfid in p9_client_walk() error path When p9_client_walk() is called with clone set to false, fid aliases oldfid. If the walk subsequently fails after the request has been sent, the error path jumps to clunk_fid, which currently calls p9_fid_put(fid) unconditionally. This drops a reference to oldfid even though ownership of oldfid remains with the caller. If this is the last reference, oldfid can be clunked and destroyed while the caller still expects it to be valid. A later use or put of oldfid can then trigger a use-after-free or refcount underflow. Fix this by only putting fid in the clunk_fid error path when it does not alias oldfid, matching the existing guard in the error path below. This can be triggered when a multi-component walk is split into multiple p9_client_walk() calls and a later non-cloning walk fails. A reproducer and refcount warning logs are available on request.
INFO
Published Date :
July 19, 2026, 12:16 p.m.
Last Modified :
Aug. 17, 2026, 5:17 a.m.
Remotely Exploit :
Yes !
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | CRITICAL | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
Solution
- Update the Linux kernel to the latest version.
- Apply the provided patch for the 9p subsystem.
- Verify fid handling in error paths.
- Test for use-after-free conditions.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-63795.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-63795 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-63795
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-63795 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-63795 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Aug. 17, 2026
Action Type Old Value New Value Changed Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'b48dbb998d70b7f48c2ec0a15c3cf47136808e4e', 'lessThan': '99c379ca1e221c3d75c7c804ebbf4e5ee37a3070', 'versionType': 'git'}, {'status': 'affected', 'version': 'b48dbb998d70b7f48c2ec0a15c3cf47136808e4e', 'lessThan': 'b84f46179c806450b89821221ea5bd9a1698aba8', 'versionType': 'git'}, {'status': 'affected', 'version': 'b48dbb998d70b7f48c2ec0a15c3cf47136808e4e', 'lessThan': 'a61bdcba4f64c2f90d01461913f429ab151f1ca6', 'versionType': 'git'}, {'status': 'affected', 'version': 'b48dbb998d70b7f48c2ec0a15c3cf47136808e4e', 'lessThan': '6dbe9443d9f5f7fb6d319a7b77108853ae6c6bea', 'versionType': 'git'}, {'status': 'affected', 'version': 'b48dbb998d70b7f48c2ec0a15c3cf47136808e4e', 'lessThan': 'a7656d368265d085ac9bb85ab31b0cdb72ad8c38', 'versionType': 'git'}, {'status': 'affected', 'version': 'b48dbb998d70b7f48c2ec0a15c3cf47136808e4e', 'lessThan': '1a3860d46e3eb47dbd60339783cdad7904486b9f', 'versionType': 'git'}], 'programFiles': ['net/9p/client.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '6.0'}, {'status': 'unaffected', 'version': '0', 'lessThan': '6.0', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.1.177', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.144', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.95', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.38', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.3', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['net/9p/client.c'], 'defaultStatus': 'affected'}] [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'b48dbb998d70b7f48c2ec0a15c3cf47136808e4e', 'lessThan': '99c379ca1e221c3d75c7c804ebbf4e5ee37a3070', 'versionType': 'git'}, {'status': 'affected', 'version': 'b48dbb998d70b7f48c2ec0a15c3cf47136808e4e', 'lessThan': 'b84f46179c806450b89821221ea5bd9a1698aba8', 'versionType': 'git'}, {'status': 'affected', 'version': 'b48dbb998d70b7f48c2ec0a15c3cf47136808e4e', 'lessThan': 'a61bdcba4f64c2f90d01461913f429ab151f1ca6', 'versionType': 'git'}, {'status': 'affected', 'version': 'b48dbb998d70b7f48c2ec0a15c3cf47136808e4e', 'lessThan': '6dbe9443d9f5f7fb6d319a7b77108853ae6c6bea', 'versionType': 'git'}, {'status': 'affected', 'version': 'b48dbb998d70b7f48c2ec0a15c3cf47136808e4e', 'lessThan': 'a7656d368265d085ac9bb85ab31b0cdb72ad8c38', 'versionType': 'git'}, {'status': 'affected', 'version': 'b48dbb998d70b7f48c2ec0a15c3cf47136808e4e', 'lessThan': '1a3860d46e3eb47dbd60339783cdad7904486b9f', 'versionType': 'git'}], 'programFiles': ['net/9p/client.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '6.0'}, {'status': 'unaffected', 'version': '0', 'lessThan': '6.0', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.1.177', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.144', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.95', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.38', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.3', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['net/9p/client.c'], 'defaultStatus': 'affected'}] -
Initial Analysis by [email protected]
Jul. 30, 2026
Action Type Old Value New Value Added CWE CWE-416 Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.2 up to (excluding) 6.6.144 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.7 up to (excluding) 6.12.95 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.13 up to (excluding) 6.18.38 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.19 up to (excluding) 7.1.3 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.0 up to (excluding) 6.1.177 Added Reference Type kernel.org: https://git.kernel.org/stable/c/1a3860d46e3eb47dbd60339783cdad7904486b9f Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/6dbe9443d9f5f7fb6d319a7b77108853ae6c6bea Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/99c379ca1e221c3d75c7c804ebbf4e5ee37a3070 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/a61bdcba4f64c2f90d01461913f429ab151f1ca6 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/a7656d368265d085ac9bb85ab31b0cdb72ad8c38 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/b84f46179c806450b89821221ea5bd9a1698aba8 Types: Patch -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jul. 20, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jul. 19, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'b48dbb998d70b7f48c2ec0a15c3cf47136808e4e', 'lessThan': '99c379ca1e221c3d75c7c804ebbf4e5ee37a3070', 'versionType': 'git'}, {'status': 'affected', 'version': 'b48dbb998d70b7f48c2ec0a15c3cf47136808e4e', 'lessThan': 'b84f46179c806450b89821221ea5bd9a1698aba8', 'versionType': 'git'}, {'status': 'affected', 'version': 'b48dbb998d70b7f48c2ec0a15c3cf47136808e4e', 'lessThan': 'a61bdcba4f64c2f90d01461913f429ab151f1ca6', 'versionType': 'git'}, {'status': 'affected', 'version': 'b48dbb998d70b7f48c2ec0a15c3cf47136808e4e', 'lessThan': '6dbe9443d9f5f7fb6d319a7b77108853ae6c6bea', 'versionType': 'git'}, {'status': 'affected', 'version': 'b48dbb998d70b7f48c2ec0a15c3cf47136808e4e', 'lessThan': 'a7656d368265d085ac9bb85ab31b0cdb72ad8c38', 'versionType': 'git'}, {'status': 'affected', 'version': 'b48dbb998d70b7f48c2ec0a15c3cf47136808e4e', 'lessThan': '1a3860d46e3eb47dbd60339783cdad7904486b9f', 'versionType': 'git'}], 'programFiles': ['net/9p/client.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '6.0'}, {'status': 'unaffected', 'version': '0', 'lessThan': '6.0', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.1.177', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.144', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.95', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.38', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.3', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['net/9p/client.c'], 'defaultStatus': 'affected'}] Added Description In the Linux kernel, the following vulnerability has been resolved: 9p: avoid putting oldfid in p9_client_walk() error path When p9_client_walk() is called with clone set to false, fid aliases oldfid. If the walk subsequently fails after the request has been sent, the error path jumps to clunk_fid, which currently calls p9_fid_put(fid) unconditionally. This drops a reference to oldfid even though ownership of oldfid remains with the caller. If this is the last reference, oldfid can be clunked and destroyed while the caller still expects it to be valid. A later use or put of oldfid can then trigger a use-after-free or refcount underflow. Fix this by only putting fid in the clunk_fid error path when it does not alias oldfid, matching the existing guard in the error path below. This can be triggered when a multi-component walk is split into multiple p9_client_walk() calls and a later non-cloning walk fails. A reproducer and refcount warning logs are available on request. Added Reference https://git.kernel.org/stable/c/1a3860d46e3eb47dbd60339783cdad7904486b9f Added Reference https://git.kernel.org/stable/c/6dbe9443d9f5f7fb6d319a7b77108853ae6c6bea Added Reference https://git.kernel.org/stable/c/99c379ca1e221c3d75c7c804ebbf4e5ee37a3070 Added Reference https://git.kernel.org/stable/c/a61bdcba4f64c2f90d01461913f429ab151f1ca6 Added Reference https://git.kernel.org/stable/c/a7656d368265d085ac9bb85ab31b0cdb72ad8c38 Added Reference https://git.kernel.org/stable/c/b84f46179c806450b89821221ea5bd9a1698aba8