CVE-2026-63800— pNFS: Fix use-after-free in pnfs_update_layout()
Possible ATT&CK Techniques 1AI
T1203 · Exploitation for Client ExecutionAffected Version Matrix 21
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | 06f58dbc49a23c99e5c0f246879ed16667f7bf8f< 4ad8b9a85dbf57ca532ee9e65ad7e6498bfbbf98 | affected |
2c8d5fc37fe2384a9bdb6965443ab9224d46f704< 1f24b8302c77dcaf79c64c073877a3b9f4dd25d2 | affected | ||
2c8d5fc37fe2384a9bdb6965443ab9224d46f704< 9c0fb5c09ae5bd68dc0038692af8127029cb0385 | affected | ||
2c8d5fc37fe2384a9bdb6965443ab9224d46f704< 7e37e9b3e82ade881e1798e2f4fcc54aff7793c1 | affected | ||
2c8d5fc37fe2384a9bdb6965443ab9224d46f704< 2883ddd7542b4437a2ab4908fe2773f690e20889 | affected | ||
2c8d5fc37fe2384a9bdb6965443ab9224d46f704< 200e7637f4d6a1342987045eea72641524f909dc | affected | ||
2c8d5fc37fe2384a9bdb6965443ab9224d46f704< 9645aaf689aff57427ece3b9fa47d5b5399417f4 | affected | ||
2c8d5fc37fe2384a9bdb6965443ab9224d46f704< 13e198a90ca4050f4bee8a3f23680389a6563ccc | affected | ||
| … +13 more rows | |||
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-63800
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
pNFS: Fix use-after-free in pnfs_update_layout()
Source: NVD (National Vulnerability Database)
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: pNFS: Fix use-after-free in pnfs_update_layout() When hitting the NFS_LAYOUT_RETURN branch in pnfs_update_layout(), the code calls pnfs_prepare_to_retry_layoutget(lo). If it succeeds, pnfs_put_layout_hdr(lo) is called before trace_pnfs_update_layout(), which still references 'lo'. This results in a use-after-free when the tracepoint accesses lo's fields. Fix this by moving the tracepoint call before pnfs_put_layout_hdr(lo).
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会开源的一款操作系统内核。 Linux kernel存在安全漏洞，该漏洞源于pnfs_update_layout()函数中的释放后重用问题，可能导致在NFS_LAYOUT_RETURN分支中，tracepoint访问已释放的lo字段。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-63800
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-63800
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-63800 (8)
Same Patch Batch · Linux · 2026-07-19 · 431 CVEs total
| CVE-2026-63795 | 10.0 CRITICAL | 9p: avoid putting oldfid in p9_client_walk() error path |
| CVE-2026-64142 | 9.8 CRITICAL | ksmbd: close durable scavenger races against m_fp_list lookups |
| CVE-2026-63993 | 9.8 CRITICAL | vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() |
| CVE-2026-64055 | 9.8 CRITICAL | net: ethernet: cortina: Carry over frag counter |
| CVE-2026-64056 | 9.8 CRITICAL | net: ethernet: cortina: Make RX SKB per-port |
| CVE-2026-64061 | 9.8 CRITICAL | netfs: Fix early put of sink folio in netfs_read_gaps() |
| CVE-2026-63984 | 9.8 CRITICAL | ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() |
| CVE-2026-64066 | 9.8 CRITICAL | netfs: Fix netfs_read_to_pagecache() to pause on subreq failure |
| CVE-2026-64067 | 9.8 CRITICAL | netfs: Fix missing barriers when accessing stream->subrequests locklessly |
| CVE-2026-63922 | 9.8 CRITICAL | ipv6: exthdrs: refresh nh after handling HAO option |
| CVE-2026-64068 | 9.8 CRITICAL | netfs: Fix missing locking around retry adding new subreqs |
| CVE-2026-63924 | 9.8 CRITICAL | ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() |
| CVE-2026-64069 | 9.8 CRITICAL | netfs: Fix cancellation of a DIO and single read subrequests |
| CVE-2026-63979 | 9.8 CRITICAL | net/handshake: hand off the pinned file reference to accept_doit |
| CVE-2026-63978 | 9.8 CRITICAL | net/handshake: Drain pending requests at net namespace exit |
| CVE-2026-64122 | 9.8 CRITICAL | net/mlx5e: Fix use-after-free in mlx5e_tx_reporter_timeout_recover |
| CVE-2026-64091 | 9.8 CRITICAL | batman-adv: tt: fix TOCTOU race for reported vlans |
| CVE-2026-64125 | 9.8 CRITICAL | net: bcmgenet: keep RBUF EEE/PM disabled |
| CVE-2026-63857 | 9.8 CRITICAL | net: airoha: Do not read uninitialized fragment address in airoha_dev_xmit() |
| CVE-2026-64089 | 9.8 CRITICAL | batman-adv: tt: fix negative last_changeset_len |
Showing top 20 of 431 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
- CVE-2026-64206
Bluetooth: L2CAP: cancel pending_rx_work before taking conn- - CVE-2026-64207
net/sched: dualpi2: fix GSO backlog accounting - CVE-2026-64205
i2c: i801: fix hardware state machine corruption in error pa - CVE-2026-64192
bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM i - CVE-2026-64191
i2c: stub: Reject I2C block transfers with invalid length
Same vendor: Linux
- CVE-2026-64206
Bluetooth: L2CAP: cancel pending_rx_work before taking conn- - CVE-2026-64207
net/sched: dualpi2: fix GSO backlog accounting - CVE-2026-64205
i2c: i801: fix hardware state machine corruption in error pa - CVE-2026-64192
bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM i - CVE-2026-64191
i2c: stub: Reject I2C block transfers with invalid length
V. Comments for CVE-2026-63800
No comments yet