In the Linux kernel, the following vulnerability has been resolved:
9p: add missing locking around taking dentry fid list
Fix a use-after-free on dentry's d_fsdata fid list when a thread looks up a fid through dentry while another thread unlinks it:
UAF thread: refcount_t: addition on 0; use-after-free. p9_fid_get linux/./include/net/9p/client.h:262 v9fs_fid_find+0x236/0x280 linux/fs/9p/fid.c:129 v9fs_fid_lookup_with_uid linux/fs/9p/fid.c:181 v9fs_fid_lookup+0xbf/0xc20 linux/fs/9p/fid.c:314 v9fs_vfs_getattr_dotl+0xf9/0x360 linux/fs/9p/vfs_inode_dotl.c:400 vfs_statx+0xdd/0x4d0 linux/fs/stat.c:248
Freed by: p9_fid_destroy (inlined) p9_client_clunk+0xb0/0xe0 linux/net/9p/client.c:1456 p9_fid_put linux/./include/net/9p/client.h:278 v9fs_dentry_release+0xb5/0x140 linux/fs/9p/vfs_dentry.c:55 v9fs_remove+0x38f/0x620 linux/fs/9p/vfs_inode.c:518 vfs_unlink+0x29a/0x810 linux/fs/namei.c:4335
The problem is that d_fsdata was not accessed under d_lock, because d_release() normally is only called once the dentry is otherwise no longer accessible but since we also call it explicitly in v9fs_remove that lock is required: move the hlist out of the dentry under lock then unref its fids once they are no longer accessible.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | Jun 25, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jun 25, 2024 |
| Suse | — | Upgrade kernel-default-optionalUpgrade kernel-develUpgrade kernel-64kb-extraUpgrade kernel-64kb-optionalUpgrade kernel-docs-htmlUpgrade kselftests-kmp-defaultUpgrade dlm-kmp-azureUpgrade kernel-kvmsmall-develUpgrade dtb-amazonUpgrade dtb-freescaleUpgrade gfs2-kmp-azureUpgrade kernel-kvmsmall-livepatch-develUpgrade dtb-lgUpgrade dtb-socionextUpgrade kernel-azure-extraUpgrade ocfs2-kmp-64kbUpgrade dtb-caviumUpgrade kernel-64kb-livepatch-develUpgrade dtb-broadcomUpgrade dtb-amdUpgrade ocfs2-kmp-azureUpgrade ocfs2-kmp-rtUpgrade dlm-kmp-defaultUpgrade dtb-apmUpgrade kernel-rt_debug-livepatch-develUpgrade ocfs2-kmp-defaultUpgrade reiserfs-kmp-defaultUpgrade kernel-default-livepatch-develUpgrade gfs2-kmp-defaultUpgrade kernel-default-livepatchUpgrade kernel-source-azureUpgrade kernel-default-develUpgrade kernel-azure-optionalUpgrade kernel-devel-rtUpgrade kernel-debugUpgrade kernel-zfcpdumpUpgrade cluster-md-kmp-azureUpgrade dtb-marvellUpgrade dtb-mediatekUpgrade kernel-rt-develUpgrade dtb-appleUpgrade gfs2-kmp-64kbUpgrade kernel-rt_debugUpgrade kernel-debug-develUpgrade kernel-default-baseUpgrade kernel-docsUpgrade kernel-64kb-develUpgrade dtb-xilinxUpgrade kernel-64kbUpgrade dtb-renesasUpgrade kselftests-kmp-rtUpgrade reiserfs-kmp-rtUpgrade cluster-md-kmp-rtUpgrade kernel-symsUpgrade dtb-allwinnerUpgrade dtb-hisiliconUpgrade kernel-rt-optionalUpgrade cluster-md-kmp-64kbUpgrade kernel-macrosUpgrade kernel-kvmsmallUpgrade kernel-debug-vdsoUpgrade kselftests-kmp-azureUpgrade kernel-kvmsmall-vdsoUpgrade dtb-nvidiaUpgrade kernel-devel-azureUpgrade dtb-rockchipUpgrade cluster-md-kmp-defaultUpgrade dtb-exynosUpgrade kernel-default-vdsoUpgrade kernel-source-rtUpgrade dtb-qcomUpgrade kernel-azureUpgrade kernel-syms-azureUpgrade kernel-azure-livepatch-develUpgrade dtb-sprdUpgrade kernel-rt-livepatch-develUpgrade reiserfs-kmp-azureUpgrade kernel-default-extraUpgrade gfs2-kmp-rtUpgrade kernel-syms-rtUpgrade kernel-rt-livepatchUpgrade dtb-amlogicUpgrade kernel-obs-buildUpgrade kselftests-kmp-64kbUpgrade kernel-rtUpgrade kernel-debug-livepatch-develUpgrade kernel-rt_debug-vdsoUpgrade kernel-rt_debug-develUpgrade kernel-azure-develUpgrade dtb-alteraUpgrade dlm-kmp-rtUpgrade kernel-rt-extraUpgrade dtb-armUpgrade dlm-kmp-64kbUpgrade kernel-source-vanillaUpgrade kernel-rt-vdsoUpgrade kernel-defaultUpgrade reiserfs-kmp-64kbUpgrade kernel-obs-qaUpgrade kernel-azure-vdsoUpgrade kernel-default-base-rebuildUpgrade kernel-source | Jul 23, 2024 | Jun 25, 2024 |
| Ubuntu | — | Upgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-azureUpgrade linux-image-5.15.0-127-generic-64kUpgrade linux-image-5.15.0-1066-raspiUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-6.8.0-1011-raspiUpgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-oem-22.04cUpgrade linux-image-5.15.0-1068-nvidiaUpgrade linux-image-5.15.0-127-genericUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-kvmUpgrade linux-image-oem-22.04bUpgrade linux-image-oem-20.04cUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-awsUpgrade linux-image-gcpUpgrade linux-image-azure-fdeUpgrade linux-image-6.8.0-1014-gcpUpgrade linux-image-oem-22.04dUpgrade linux-image-nvidia-64kUpgrade linux-image-5.15.0-1070-kvmUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-5.15.0-1078-azureUpgrade linux-image-gkeop-5.15Upgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-6.8.0-44-generic-64kUpgrade linux-image-oem-20.04dUpgrade linux-image-raspiUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-generic-hwe-22.04Upgrade linux-image-5.15.0-127-lowlatencyUpgrade linux-image-virtual-hwe-20.04Upgrade linux-image-6.8.0-1013-nvidia-64kUpgrade linux-image-6.8.0-1013-nvidia-lowlatencyUpgrade linux-image-6.8.0-1014-azure-fdeUpgrade linux-image-5.15.0-127-lowlatency-64kUpgrade linux-image-5.15.0-1071-oracleUpgrade linux-image-oracle-64kUpgrade linux-image-oracle-lts-22.04Upgrade linux-image-generic-hwe-20.04Upgrade linux-image-azure-cvmUpgrade linux-image-aws-lts-22.04Upgrade linux-image-nvidiaUpgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-lowlatencyUpgrade linux-image-gkeUpgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-intelUpgrade linux-image-5.15.0-1072-gcpUpgrade linux-image-oem-20.04Upgrade linux-image-5.15.0-1039-xilinx-zynqmpUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-generic-lpaeUpgrade linux-image-6.8.0-1013-nvidiaUpgrade linux-image-6.8.0-1010-gkeUpgrade linux-image-oem-22.04aUpgrade linux-image-5.15.0-1073-awsUpgrade linux-image-6.8.0-44-genericUpgrade linux-image-oem-20.04bUpgrade linux-image-oem-22.04Upgrade linux-image-gke-5.15Upgrade linux-image-5.15.0-1068-nvidia-lowlatencyUpgrade linux-image-gkeopUpgrade linux-image-6.8.0-1012-ibmUpgrade linux-image-6.8.0-45-generic-64kUpgrade linux-image-nvidia-6.8Upgrade linux-image-virtualUpgrade linux-image-6.8.0-1012-oracleUpgrade linux-image-5.15.0-1071-intel-iotgUpgrade linux-image-6.8.0-44-lowlatencyUpgrade linux-image-genericUpgrade linux-image-ibmUpgrade linux-image-raspi-nolpaeUpgrade linux-image-6.8.0-1013-nvidia-lowlatency-64kUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-oracleUpgrade linux-image-lowlatency-64kUpgrade linux-image-6.8.0-1014-azureUpgrade linux-image-6.8.0-1012-oemUpgrade linux-image-6.8.0-1012-oracle-64kUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-ibm-classicUpgrade linux-image-generic-64kUpgrade linux-image-intel-iotgUpgrade linux-image-5.15.0-1070-gkeUpgrade linux-image-6.8.0-1015-awsUpgrade linux-image-gcp-lts-22.04Upgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-6.8.0-44-lowlatency-64kUpgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-5.15.0-127-generic-lpaeUpgrade linux-image-5.15.0-1056-gkeopUpgrade linux-image-6.8.0-45-genericUpgrade linux-image-5.15.0-1066-ibmUpgrade linux-image-azure-lts-22.04 | Sep 12, 2024 | Jun 25, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 14, 2025 | Jun 25, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub