In the Linux kernel, the following vulnerability has been resolved:
9p: add missing locking around taking dentry fid list
Fix a use-after-free on dentry's d_fsdata fid list when a thread looks up a fid through dentry while another thread unlinks it:
UAF thread: refcount_t: addition on 0; use-after-free. p9_fid_get linux/./include/net/9p/client.h:262 v9fs_fid_find+0x236/0x280 linux/fs/9p/fid.c:129 v9fs_fid_lookup_with_uid linux/fs/9p/fid.c:181 v9fs_fid_lookup+0xbf/0xc20 linux/fs/9p/fid.c:314 v9fs_vfs_getattr_dotl+0xf9/0x360 linux/fs/9p/vfs_inode_dotl.c:400 vfs_statx+0xdd/0x4d0 linux/fs/stat.c:248
Freed by: p9_fid_destroy (inlined) p9_client_clunk+0xb0/0xe0 linux/net/9p/client.c:1456 p9_fid_put linux/./include/net/9p/client.h:278 v9fs_dentry_release+0xb5/0x140 linux/fs/9p/vfs_dentry.c:55 v9fs_remove+0x38f/0x620 linux/fs/9p/vfs_inode.c:518 vfs_unlink+0x29a/0x810 linux/fs/namei.c:4335
The problem is that d_fsdata was not accessed under d_lock, because d_release() normally is only called once the dentry is otherwise no longer accessible but since we also call it explicitly in v9fs_remove that lock is required: move the hlist out of the dentry under lock then unref its fids once they are no longer accessible.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | Jun 25, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jun 25, 2024 |
| Suse | — | Upgrade kernel-kvmsmall-vdsoUpgrade kernel-sourceUpgrade dtb-qcomUpgrade kernel-syms-azureUpgrade gfs2-kmp-rtUpgrade kernel-rt-livepatchUpgrade dtb-sprdUpgrade cluster-md-kmp-defaultUpgrade kernel-kvmsmallUpgrade kernel-macrosUpgrade kernel-rt-livepatch-develUpgrade kernel-default-extraUpgrade kernel-azureUpgrade kernel-syms-rtUpgrade dtb-nvidiaUpgrade kernel-devel-azureUpgrade kernel-azure-livepatch-develUpgrade kernel-azure-vdsoUpgrade kernel-debug-livepatch-develUpgrade reiserfs-kmp-64kbUpgrade kernel-rt-vdsoUpgrade kernel-obs-qaUpgrade kernel-rt-extraUpgrade kernel-source-rtUpgrade kernel-defaultUpgrade kernel-source-vanillaUpgrade dtb-armUpgrade kernel-default-base-rebuildUpgrade dtb-exynosUpgrade dlm-kmp-64kbUpgrade kernel-default-vdsoUpgrade cluster-md-kmp-64kbUpgrade dtb-rockchipUpgrade kernel-obs-buildUpgrade kernel-debug-vdsoUpgrade dtb-amlogicUpgrade kernel-rtUpgrade kselftests-kmp-64kbUpgrade kernel-rt-optionalUpgrade kernel-rt_debug-vdsoUpgrade reiserfs-kmp-azureUpgrade kernel-rt_debug-develUpgrade dlm-kmp-rtUpgrade kernel-azure-develUpgrade dtb-alteraUpgrade kselftests-kmp-azureUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-docs-htmlUpgrade kernel-develUpgrade kernel-kvmsmall-develUpgrade kernel-debugUpgrade dtb-allwinnerUpgrade kselftests-kmp-rtUpgrade kernel-rt_debugUpgrade kernel-default-baseUpgrade dtb-mediatekUpgrade dtb-marvellUpgrade kernel-symsUpgrade dtb-xilinxUpgrade dlm-kmp-defaultUpgrade ocfs2-kmp-rtUpgrade ocfs2-kmp-azureUpgrade kernel-default-livepatch-develUpgrade gfs2-kmp-defaultUpgrade dtb-caviumUpgrade dtb-broadcomUpgrade kernel-64kb-livepatch-develUpgrade kernel-source-azureUpgrade kernel-devel-rtUpgrade kernel-azure-optionalUpgrade ocfs2-kmp-defaultUpgrade kernel-64kbUpgrade dtb-renesasUpgrade dtb-hisiliconUpgrade reiserfs-kmp-rtUpgrade cluster-md-kmp-azureUpgrade dtb-freescaleUpgrade kernel-azure-extraUpgrade kselftests-kmp-defaultUpgrade gfs2-kmp-azureUpgrade kernel-64kb-develUpgrade kernel-kvmsmall-livepatch-develUpgrade dlm-kmp-azureUpgrade kernel-default-optionalUpgrade kernel-64kb-extraUpgrade kernel-docsUpgrade kernel-debug-develUpgrade gfs2-kmp-64kbUpgrade dtb-appleUpgrade ocfs2-kmp-64kbUpgrade dtb-lgUpgrade kernel-64kb-optionalUpgrade dtb-amazonUpgrade kernel-default-livepatchUpgrade kernel-default-develUpgrade kernel-zfcpdumpUpgrade reiserfs-kmp-defaultUpgrade dtb-socionextUpgrade cluster-md-kmp-rtUpgrade dtb-amdUpgrade kernel-rt-develUpgrade dtb-apm | Jul 23, 2024 | Jun 25, 2024 |
| Ubuntu | — | Upgrade linux-image-nvidiaUpgrade linux-image-generic-64kUpgrade linux-image-gcp-lts-22.04Upgrade linux-image-6.8.0-1013-nvidiaUpgrade linux-image-ibmUpgrade linux-image-lowlatency-64kUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-5.15.0-1056-gkeopUpgrade linux-image-6.8.0-45-genericUpgrade linux-image-6.8.0-44-lowlatency-64kUpgrade linux-image-genericUpgrade linux-image-6.8.0-1012-oracleUpgrade linux-image-5.15.0-127-generic-lpaeUpgrade linux-image-6.8.0-1013-nvidia-lowlatency-64kUpgrade linux-image-gkeUpgrade linux-image-gke-5.15Upgrade linux-image-6.8.0-45-generic-64kUpgrade linux-image-nvidia-6.8Upgrade linux-image-virtualUpgrade linux-image-gkeopUpgrade linux-image-aws-lts-22.04Upgrade linux-image-intel-iotgUpgrade linux-image-6.8.0-1012-ibmUpgrade linux-image-6.8.0-1012-oracle-64kUpgrade linux-image-5.15.0-1070-gkeUpgrade linux-image-oem-20.04Upgrade linux-image-6.8.0-1012-oemUpgrade linux-image-raspi-nolpaeUpgrade linux-image-oracleUpgrade linux-image-6.8.0-1015-awsUpgrade linux-image-ibm-classicUpgrade linux-image-6.8.0-1014-azureUpgrade linux-image-6.8.0-1010-gkeUpgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-5.15.0-1068-nvidia-lowlatencyUpgrade linux-image-5.15.0-1073-awsUpgrade linux-image-oem-22.04Upgrade linux-image-6.8.0-44-genericUpgrade linux-image-oem-20.04bUpgrade linux-image-oem-22.04aUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-5.15.0-1066-ibmUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-5.15.0-1071-intel-iotgUpgrade linux-image-5.15.0-1072-gcpUpgrade linux-image-lowlatencyUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-intelUpgrade linux-image-generic-lpaeUpgrade linux-image-5.15.0-1039-xilinx-zynqmpUpgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-6.8.0-44-lowlatencyUpgrade linux-image-azure-lts-22.04Upgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-oem-20.04dUpgrade linux-image-kvmUpgrade linux-image-5.15.0-127-genericUpgrade linux-image-awsUpgrade linux-image-virtual-hwe-20.04Upgrade linux-image-generic-hwe-22.04Upgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-6.8.0-1011-raspiUpgrade linux-image-6.8.0-44-generic-64kUpgrade linux-image-5.15.0-1078-azureUpgrade linux-image-gkeop-5.15Upgrade linux-image-5.15.0-1068-nvidiaUpgrade linux-image-nvidia-64kUpgrade linux-image-raspiUpgrade linux-image-5.15.0-127-generic-64kUpgrade linux-image-azure-fdeUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-oracle-lts-22.04Upgrade linux-image-6.8.0-1013-nvidia-lowlatencyUpgrade linux-image-oem-22.04cUpgrade linux-image-6.8.0-1014-gcpUpgrade linux-image-6.8.0-1014-azure-fdeUpgrade linux-image-6.8.0-1013-nvidia-64kUpgrade linux-image-oem-22.04bUpgrade linux-image-5.15.0-127-lowlatency-64kUpgrade linux-image-oem-20.04cUpgrade linux-image-5.15.0-1071-oracleUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-5.15.0-1066-raspiUpgrade linux-image-oracle-64kUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-virtual-hwe-22.04Upgrade linux-image-virtual-hwe-24.04Upgrade linux-image-generic-hwe-20.04Upgrade linux-image-azure-cvmUpgrade linux-image-oem-22.04dUpgrade linux-image-5.15.0-127-lowlatencyUpgrade linux-image-5.15.0-1070-kvmUpgrade linux-image-azureUpgrade linux-image-gcp | Sep 12, 2024 | Jun 25, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 14, 2025 | Jun 25, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub