CVE-2026-63800pNFS: Fix use-after-free in pnfs_update_layout()
Updated under an hour ago ()
Does this affect you?
It affects Linux and 1 other product. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: pNFS: Fix use-after-free in pnfs_update_layout() When hitting the NFS_LAYOUT_RETURN branch in pnfs_update_layout(), the code calls pnfs_prepare_to_retry_layoutget(lo). If it succeeds, pnfs_put_layout_hdr(lo) is called before trace_pnfs_update_layout(), which still references 'lo'. This results in a use-after-free when the tracepoint accesses lo's fields. Fix this by moving the tracepoint call before pnfs_put_layout_hdr(lo).
- CVSS
- 9.8 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Analyzed
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | 06f58dbc49a23c99e5c0f246879ed16667f7bf8f builds before 4ad8b9a85dbf57ca532ee9e65ad7e6498bfbbf98; 2c8d5fc37fe2384a9bdb6965443ab9224d46f704 builds before 1f24b8302c77dcaf79c64c073877a3b9f4dd25d2; from 2c8d5fc37fe2384a9bdb6965443ab9224d46f704 before 9c0fb5c09ae5bd68dc0038692af8127029cb0385; from 2c8d5fc37fe2384a9bdb6965443ab9224d46f704 before 7e37e9b3e82ade881e1798e2f4fcc54aff7793c1; from 2c8d5fc37fe2384a9bdb6965443ab9224d46f704 before 2883ddd7542b4437a2ab4908fe2773f690e20889; from 2c8d5fc37fe2384a9bdb6965443ab9224d46f704 before 200e7637f4d6a1342987045eea72641524f909dc; from 2c8d5fc37fe2384a9bdb6965443ab9224d46f704 before 9645aaf689aff57427ece3b9fa47d5b5399417f4; from 2c8d5fc37fe2384a9bdb6965443ab9224d46f704 before 13e198a90ca4050f4bee8a3f23680389a6563ccc; and 3 more ranges | CNA record |
linux linux_kernel linux:linux_kernel | from 5.4.91 before 5.5; from 5.10.9 before 5.10.260; from 5.11.1 before 5.15.211; from 5.16 before 6.1.177; from 6.2 before 6.6.144; from 6.7 before 6.12.95; from 6.13 before 6.18.38; from 6.19 before 7.1.3; and 5 more ranges | NVD |
References
- https://git.kernel.org/stable/c/4ad8b9a85dbf57ca532ee9e65ad7e6498bfbbf98patch
- https://git.kernel.org/stable/c/1f24b8302c77dcaf79c64c073877a3b9f4dd25d2patch
- https://git.kernel.org/stable/c/9c0fb5c09ae5bd68dc0038692af8127029cb0385patch
- https://git.kernel.org/stable/c/7e37e9b3e82ade881e1798e2f4fcc54aff7793c1patch
- https://git.kernel.org/stable/c/2883ddd7542b4437a2ab4908fe2773f690e20889patch
- https://git.kernel.org/stable/c/200e7637f4d6a1342987045eea72641524f909dcpatch
- https://git.kernel.org/stable/c/9645aaf689aff57427ece3b9fa47d5b5399417f4patch
- https://git.kernel.org/stable/c/13e198a90ca4050f4bee8a3f23680389a6563cccpatch
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.