CVE-2026-63795

Estado: AnalizadaCrítica (10)—

In the Linux kernel, the following vulnerability has been resolved:

9p: avoid putting oldfid in p9_client_walk() error path

When p9_client_walk() is called with clone set to false, fid aliases oldfid. If the walk subsequently fails after the request has been sent, the error path jumps to clunk_fid, which currently calls p9_fid_put(fid) unconditionally.

This drops a reference to oldfid even though ownership of oldfid remains with the caller. If this is the last reference, oldfid can be clunked and destroyed while the caller still expects it to be valid. A later use or put of oldfid can then trigger a use-after-free or refcount underflow.

Leer descripción completaMostrar menos

Fix this by only putting fid in the clunk_fid error path when it does not alias oldfid, matching the existing guard in the error path below.

This can be triggered when a multi-component walk is split into multiple p9_client_walk() calls and a later non-cloning walk fails. A reproducer and refcount warning logs are available on request.

CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Puntuación base: 10

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.50%
Percentil entre todas las CVEs puntuadas: 41
Fecha de la puntuación: 6/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1190 Exploit Public-Facing Applicationinitial access60 %
Impacto principalT1059 Command and Scripting Interpreterexecution55 %

Inferido por reglas deterministas a partir del vector CVSS y la CWE. Solo orientativo.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account Management Vulnerability Scanning Restrict Web-Based Content Network Segmentation Limit Software Installation Limit Access to Resource Over Network

Tecnologías afectadas (1)

Linux — Linux Kernel

CWE

CWE-416

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2026-63795",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 10,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "b48dbb998d70b7f48c2ec0a15c3cf47136808e4e",
              "lessThan": "99c379ca1e221c3d75c7c804ebbf4e5ee37a3070",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b48dbb998d70b7f48c2ec0a15c3cf47136808e4e",
              "lessThan": "b84f46179c806450b89821221ea5bd9a1698aba8",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b48dbb998d70b7f48c2ec0a15c3cf47136808e4e",
              "lessThan": "a61bdcba4f64c2f90d01461913f429ab151f1ca6",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b48dbb998d70b7f48c2ec0a15c3cf47136808e4e",
              "lessThan": "6dbe9443d9f5f7fb6d319a7b77108853ae6c6bea",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b48dbb998d70b7f48c2ec0a15c3cf47136808e4e",
              "lessThan": "a7656d368265d085ac9bb85ab31b0cdb72ad8c38",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b48dbb998d70b7f48c2ec0a15c3cf47136808e4e",
              "lessThan": "1a3860d46e3eb47dbd60339783cdad7904486b9f",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "net/9p/client.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "6.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.1.177",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.144",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.95",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.38",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.1.3",
              "versionType": "semver",
              "lessThanOrEqual": "7.1.*"
            },
            {
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "net/9p/client.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-07-19T12:16:51.910",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/1a3860d46e3eb47dbd60339783cdad7904486b9f",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/6dbe9443d9f5f7fb6d319a7b77108853ae6c6bea",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/99c379ca1e221c3d75c7c804ebbf4e5ee37a3070",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/a61bdcba4f64c2f90d01461913f429ab151f1ca6",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/a7656d368265d085ac9bb85ab31b0cdb72ad8c38",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/b84f46179c806450b89821221ea5bd9a1698aba8",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-416"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\n9p: avoid putting oldfid in p9_client_walk() error path\n\nWhen p9_client_walk() is called with clone set to false, fid aliases\noldfid. If the walk subsequently fails after the request has been sent,\nthe error path jumps to clunk_fid, which currently calls p9_fid_put(fid)\nunconditionally.\n\nThis drops a reference to oldfid even though ownership of oldfid remains\nwith the caller. If this is the last reference, oldfid can be clunked and\ndestroyed while the caller still expects it to be valid. A later use or\nput of oldfid can then trigger a use-after-free or refcount underflow.\n\nFix this by only putting fid in the clunk_fid error path when it does not\nalias oldfid, matching the existing guard in the error path below.\n\nThis can be triggered when a multi-component walk is split into multiple\np9_client_walk() calls and a later non-cloning walk fails. A reproducer\nand refcount warning logs are available on request."
    }
  ],
  "lastModified": "2026-08-17T05:17:15.657",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E1C3142A-8469-4087-A10A-726FF6961047",
              "versionEndExcluding": "6.1.177",
              "versionStartIncluding": "6.0"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C8AD3BC8-C843-423C-B9DB-CB52F67F578E",
              "versionEndExcluding": "6.6.144",
              "versionStartIncluding": "6.2"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4E206B86-E0E3-4394-A93F-39F2D50A8AA8",
              "versionEndExcluding": "6.12.95",
              "versionStartIncluding": "6.7"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FA591B28-5D62-449E-BDBE-3C9391BF070A",
              "versionEndExcluding": "6.18.38",
              "versionStartIncluding": "6.13"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9526B150-E2B3-4C6F-8AE5-1AF92B75AD9E",
              "versionEndExcluding": "7.1.3",
              "versionStartIncluding": "6.19"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}