PT-2026-61116 · Linux · Linux

CVE-2026-63800 · Published 2026-07-19 · Updated 2026-07-19

NVD

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

In the Linux kernel, the following vulnerability has been resolved:

pNFS: Fix use-after-free in pnfs update layout()

When hitting the NFS LAYOUT RETURN branch in pnfs update layout(), the code calls pnfs prepare to retry layoutget(lo). If it succeeds, pnfs put layout hdr(lo) is called before trace pnfs update layout(), which still references 'lo'. This results in a use-after-free when the tracepoint accesses lo's fields.

Fix this by moving the tracepoint call before pnfs put layout hdr(lo).

Fix

Related Identifiers

CVE-2026-63800

Affected Products

Linux

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-63800 · Security Note
• https://git.kernel.org/stable/c/7e37e9b3e82ade881e1798e2f4fcc54aff7793c1 · Note
• https://git.kernel.org/stable/c/9645aaf689aff57427ece3b9fa47d5b5399417f4 · Note
• https://git.kernel.org/stable/c/2883ddd7542b4437a2ab4908fe2773f690e20889 · Note
• https://git.kernel.org/stable/c/200e7637f4d6a1342987045eea72641524f909dc · Note
• https://git.kernel.org/stable/c/9c0fb5c09ae5bd68dc0038692af8127029cb0385 · Note
• https://git.kernel.org/stable/c/1f24b8302c77dcaf79c64c073877a3b9f4dd25d2 · Note
• https://git.kernel.org/stable/c/4ad8b9a85dbf57ca532ee9e65ad7e6498bfbbf98 · Note
• https://git.kernel.org/stable/c/13e198a90ca4050f4bee8a3f23680389a6563ccc · Note