{"id":14873,"date":"2026-09-04T19:02:16","date_gmt":"2026-09-04T11:02:16","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-63795"},"modified":"2026-09-04T19:02:16","modified_gmt":"2026-09-04T11:02:16","slug":"cve-2026-63795","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-63795","title":{"rendered":"CVE-2026-63795 [CRITICAL] &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\n9p: avoid putting old"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>9p: avoid putting oldfid in p9_client_walk() error path<\/p>\n<p>When p9_client_walk() is called with clone set to false, fid aliases<br \/>\noldfid. If the walk subsequently fails after the request has been sent,<br \/>\nthe error path jumps to clunk_fid, which currently calls p9_fid_put(fid)<br \/>\nunconditionally.<\/p>\n<p>This drops a reference to oldfid even though ownership of oldfid remains<br \/>\nwith the caller. If this is the last reference, oldfid can be clunked and<br \/>\ndestroyed while the caller still expects it to be valid. A later use or<br \/>\nput of oldfid can then trigger a use-after-free or refcount underflow.<\/p>\n<p>Fix this by only putting fid in the clunk_fid error path when it does not<br \/>\nalias oldfid, matching the existing guard in the error path below.<\/p>\n<p>This can be triggered when a multi-component walk is split into multiple<br \/>\np9_client_walk() calls and a later non-cloning walk fails. A reproducer<br \/>\nand refcount warning logs are available on request.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>9p: avoid putting oldfid in p9_client_walk() error path<\/p>\n<p>When p9_client_walk() is called with clone set to false, fid aliases<br \/>\noldfi<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-14873","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/14873","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=14873"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=14873"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=14873"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}