In the Linux kernel, the following vulnerability has been resolved: pNFS: Fix use-after-free in pnfs_update_layout() When hitting the NFS_LAYOUT_RETURN branch in pnfs_update_layout(), the code calls pnfs_prepare_to_retry_layoutget(lo). If it succeeds, pnfs_put_layout_hdr(lo) is called before trace_pnfs_update_layout(), which still references 'lo'. This results in a use-after-free when the tracepoint accesses lo's fields. Fix this by moving the tracepoint call before pnfs_put_layout_hdr(lo).

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

Vendors Products
Linux
  • Linux Kernel

No data.

No data.

References
Link Providers
https://git.kernel.org/stable/c/13e198a90ca4050f4bee8a3f23680389a6563ccc cve-icon
https://git.kernel.org/stable/c/1f24b8302c77dcaf79c64c073877a3b9f4dd25d2 cve-icon
https://git.kernel.org/stable/c/200e7637f4d6a1342987045eea72641524f909dc cve-icon
https://git.kernel.org/stable/c/2883ddd7542b4437a2ab4908fe2773f690e20889 cve-icon
https://git.kernel.org/stable/c/4ad8b9a85dbf57ca532ee9e65ad7e6498bfbbf98 cve-icon
https://git.kernel.org/stable/c/7e37e9b3e82ade881e1798e2f4fcc54aff7793c1 cve-icon
https://git.kernel.org/stable/c/9645aaf689aff57427ece3b9fa47d5b5399417f4 cve-icon
https://git.kernel.org/stable/c/9c0fb5c09ae5bd68dc0038692af8127029cb0385 cve-icon
History

Mon, 20 Jul 2026 14:45:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Sun, 19 Jul 2026 12:15:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: pNFS: Fix use-after-free in pnfs_update_layout() When hitting the NFS_LAYOUT_RETURN branch in pnfs_update_layout(), the code calls pnfs_prepare_to_retry_layoutget(lo). If it succeeds, pnfs_put_layout_hdr(lo) is called before trace_pnfs_update_layout(), which still references 'lo'. This results in a use-after-free when the tracepoint accesses lo's fields. Fix this by moving the tracepoint call before pnfs_put_layout_hdr(lo).
Title pNFS: Fix use-after-free in pnfs_update_layout()
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-19T12:02:06.897Z

Updated: 2026-07-20T13:40:10.522Z

Reserved: 2026-07-19T07:54:57.013Z

Link: CVE-2026-63800

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.