In the Linux kernel, the following vulnerability has been resolved:
9p: add missing locking around taking dentry fid list
Fix a use-after-free on dentry's d_fsdata fid list when a thread looks up a fid through dentry while another thread unlinks it:
UAF thread: refcount_t: addition on 0; use-after-free. p9_fid_get linux/./include/net/9p/client.h:262 v9fs_fid_find+0x236/0x280 linux/fs/9p/fid.c:129 v9fs_fid_lookup_with_uid linux/fs/9p/fid.c:181 v9fs_fid_lookup+0xbf/0xc20 linux/fs/9p/fid.c:314 v9fs_vfs_getattr_dotl+0xf9/0x360 linux/fs/9p/vfs_inode_dotl.c:400 vfs_statx+0xdd/0x4d0 linux/fs/stat.c:248
Freed by: p9_fid_destroy (inlined) p9_client_clunk+0xb0/0xe0 linux/net/9p/client.c:1456 p9_fid_put linux/./include/net/9p/client.h:278 v9fs_dentry_release+0xb5/0x140 linux/fs/9p/vfs_dentry.c:55 v9fs_remove+0x38f/0x620 linux/fs/9p/vfs_inode.c:518 vfs_unlink+0x29a/0x810 linux/fs/namei.c:4335
The problem is that d_fsdata was not accessed under d_lock, because d_release() normally is only called once the dentry is otherwise no longer accessible but since we also call it explicitly in v9fs_remove that lock is required: move the hlist out of the dentry under lock then unref its fids once they are no longer accessible.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | Jun 25, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jun 25, 2024 |
| Suse | — | Upgrade kselftests-kmp-azureUpgrade kernel-rt-livepatch-develUpgrade kernel-azureUpgrade dtb-rockchipUpgrade kernel-syms-rtUpgrade dtb-qcomUpgrade gfs2-kmp-rtUpgrade dtb-alteraUpgrade kernel-kvmsmall-vdsoUpgrade kernel-debug-livepatch-develUpgrade kernel-default-extraUpgrade kernel-default-vdsoUpgrade reiserfs-kmp-azureUpgrade kernel-rt_debug-develUpgrade kernel-rt-livepatchUpgrade kernel-azure-livepatch-develUpgrade cluster-md-kmp-64kbUpgrade kernel-azure-vdsoUpgrade kernel-default-base-rebuildUpgrade kernel-rt_debug-vdsoUpgrade kernel-rt-extraUpgrade dtb-exynosUpgrade dlm-kmp-64kbUpgrade kernel-source-rtUpgrade reiserfs-kmp-64kbUpgrade kernel-rt-vdsoUpgrade kernel-source-vanillaUpgrade kernel-defaultUpgrade dtb-armUpgrade kernel-azure-develUpgrade kernel-obs-qaUpgrade kernel-debug-vdsoUpgrade kernel-rt-optionalUpgrade dlm-kmp-rtUpgrade dtb-sprdUpgrade kernel-rtUpgrade kernel-macrosUpgrade kernel-obs-buildUpgrade kernel-devel-azureUpgrade kernel-kvmsmallUpgrade dtb-nvidiaUpgrade kernel-syms-azureUpgrade kernel-sourceUpgrade cluster-md-kmp-defaultUpgrade kselftests-kmp-64kbUpgrade dtb-amlogicUpgrade kernel-default-livepatch-develUpgrade gfs2-kmp-defaultUpgrade dtb-socionextUpgrade dtb-amazonUpgrade dlm-kmp-azureUpgrade kernel-develUpgrade kernel-default-optionalUpgrade kernel-64kb-optionalUpgrade kernel-64kb-extraUpgrade gfs2-kmp-azureUpgrade kselftests-kmp-defaultUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-kvmsmall-develUpgrade dtb-mediatekUpgrade kernel-debugUpgrade kernel-default-baseUpgrade dtb-marvellUpgrade kernel-rt_debugUpgrade reiserfs-kmp-defaultUpgrade dtb-amdUpgrade kernel-zfcpdumpUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-rt-develUpgrade kernel-default-livepatchUpgrade kernel-default-develUpgrade kernel-64kb-develUpgrade dtb-apmUpgrade kernel-devel-rtUpgrade kernel-azure-optionalUpgrade ocfs2-kmp-defaultUpgrade cluster-md-kmp-azureUpgrade kernel-docsUpgrade ocfs2-kmp-azureUpgrade dtb-caviumUpgrade dtb-broadcomUpgrade kernel-64kb-livepatch-develUpgrade kernel-debug-develUpgrade dtb-appleUpgrade kernel-source-azureUpgrade ocfs2-kmp-rtUpgrade dlm-kmp-defaultUpgrade gfs2-kmp-64kbUpgrade kernel-symsUpgrade dtb-allwinnerUpgrade kselftests-kmp-rtUpgrade kernel-64kbUpgrade dtb-xilinxUpgrade dtb-freescaleUpgrade cluster-md-kmp-rtUpgrade kernel-azure-extraUpgrade dtb-renesasUpgrade dtb-lgUpgrade dtb-hisiliconUpgrade reiserfs-kmp-rtUpgrade ocfs2-kmp-64kbUpgrade kernel-docs-html | Jul 23, 2024 | Jun 25, 2024 |
| Ubuntu | — | Upgrade linux-image-generic-hwe-22.04Upgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-oem-22.04dUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-5.15.0-1066-raspiUpgrade linux-image-6.8.0-44-generic-64kUpgrade linux-image-nvidia-64kUpgrade linux-image-6.8.0-1014-azure-fdeUpgrade linux-image-6.8.0-1013-nvidia-64kUpgrade linux-image-generic-hwe-20.04Upgrade linux-image-gkeop-5.15Upgrade linux-image-5.15.0-127-lowlatencyUpgrade linux-image-5.15.0-1078-azureUpgrade linux-image-oracle-lts-22.04Upgrade linux-image-6.8.0-1014-gcpUpgrade linux-image-azure-fdeUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-5.15.0-127-lowlatency-64kUpgrade linux-image-raspiUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-oem-22.04cUpgrade linux-image-6.8.0-1013-nvidia-lowlatencyUpgrade linux-image-oracle-64kUpgrade linux-image-oem-22.04bUpgrade linux-image-6.8.0-1011-raspiUpgrade linux-image-azure-cvmUpgrade linux-image-5.15.0-1071-oracleUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-oem-20.04cUpgrade linux-image-azureUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-5.15.0-1070-kvmUpgrade linux-image-gcpUpgrade linux-image-kvmUpgrade linux-image-virtual-hwe-20.04Upgrade linux-image-5.15.0-127-genericUpgrade linux-image-5.15.0-1068-nvidiaUpgrade linux-image-5.15.0-127-generic-64kUpgrade linux-image-oem-20.04dUpgrade linux-image-awsUpgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-xilinx-zynqmpUpgrade linux-image-6.8.0-44-lowlatency-64kUpgrade linux-image-oem-20.04Upgrade linux-image-5.15.0-1039-xilinx-zynqmpUpgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-generic-lpaeUpgrade linux-image-lowlatencyUpgrade linux-image-6.8.0-45-genericUpgrade linux-image-5.15.0-1056-gkeopUpgrade linux-image-5.15.0-127-generic-lpaeUpgrade linux-image-5.15.0-1071-intel-iotgUpgrade linux-image-6.8.0-1013-nvidiaUpgrade linux-image-5.15.0-1072-gcpUpgrade linux-image-ibm-classicUpgrade linux-image-6.8.0-1012-oracle-64kUpgrade linux-image-intelUpgrade linux-image-6.8.0-1015-awsUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-intel-iotgUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-azure-lts-22.04Upgrade linux-image-virtualUpgrade linux-image-5.15.0-1066-ibmUpgrade linux-image-6.8.0-44-lowlatencyUpgrade linux-image-gke-5.15Upgrade linux-image-nvidia-6.8Upgrade linux-image-gkeUpgrade linux-image-gkeopUpgrade linux-image-6.8.0-44-genericUpgrade linux-image-5.15.0-1068-nvidia-lowlatencyUpgrade linux-image-oem-22.04Upgrade linux-image-oem-20.04bUpgrade linux-image-6.8.0-1010-gkeUpgrade linux-image-oem-22.04aUpgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-aws-lts-22.04Upgrade linux-image-5.15.0-1073-awsUpgrade linux-image-6.8.0-1012-ibmUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-nvidiaUpgrade linux-image-ibmUpgrade linux-image-6.8.0-1013-nvidia-lowlatency-64kUpgrade linux-image-6.8.0-1012-oracleUpgrade linux-image-genericUpgrade linux-image-6.8.0-1012-oemUpgrade linux-image-gcp-lts-22.04Upgrade linux-image-generic-64kUpgrade linux-image-6.8.0-45-generic-64kUpgrade linux-image-5.15.0-1070-gkeUpgrade linux-image-oracleUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-raspi-nolpaeUpgrade linux-image-6.8.0-1014-azureUpgrade linux-image-lowlatency-64k | Sep 12, 2024 | Jun 25, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 14, 2025 | Jun 25, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub