In the Linux kernel, the following vulnerability has been resolved:
9p: add missing locking around taking dentry fid list
Fix a use-after-free on dentry's d_fsdata fid list when a thread looks up a fid through dentry while another thread unlinks it:
UAF thread: refcount_t: addition on 0; use-after-free. p9_fid_get linux/./include/net/9p/client.h:262 v9fs_fid_find+0x236/0x280 linux/fs/9p/fid.c:129 v9fs_fid_lookup_with_uid linux/fs/9p/fid.c:181 v9fs_fid_lookup+0xbf/0xc20 linux/fs/9p/fid.c:314 v9fs_vfs_getattr_dotl+0xf9/0x360 linux/fs/9p/vfs_inode_dotl.c:400 vfs_statx+0xdd/0x4d0 linux/fs/stat.c:248
Freed by: p9_fid_destroy (inlined) p9_client_clunk+0xb0/0xe0 linux/net/9p/client.c:1456 p9_fid_put linux/./include/net/9p/client.h:278 v9fs_dentry_release+0xb5/0x140 linux/fs/9p/vfs_dentry.c:55 v9fs_remove+0x38f/0x620 linux/fs/9p/vfs_inode.c:518 vfs_unlink+0x29a/0x810 linux/fs/namei.c:4335
The problem is that d_fsdata was not accessed under d_lock, because d_release() normally is only called once the dentry is otherwise no longer accessible but since we also call it explicitly in v9fs_remove that lock is required: move the hlist out of the dentry under lock then unref its fids once they are no longer accessible.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | Jun 25, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jun 25, 2024 |
| Suse | — | Upgrade dtb-socionextUpgrade gfs2-kmp-azureUpgrade dtb-amazonUpgrade kernel-64kb-extraUpgrade kernel-develUpgrade kselftests-kmp-defaultUpgrade kernel-64kb-optionalUpgrade kernel-default-optionalUpgrade kernel-docs-htmlUpgrade kernel-azure-extraUpgrade dtb-amdUpgrade kernel-kvmsmall-develUpgrade kernel-azure-optionalUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-64kb-develUpgrade dtb-freescaleUpgrade reiserfs-kmp-defaultUpgrade dtb-hisiliconUpgrade dlm-kmp-azureUpgrade kernel-rt-develUpgrade dtb-mediatekUpgrade kernel-devel-rtUpgrade kernel-default-livepatchUpgrade dtb-appleUpgrade dtb-apmUpgrade dtb-renesasUpgrade ocfs2-kmp-defaultUpgrade kernel-rt_debugUpgrade ocfs2-kmp-64kbUpgrade kernel-default-develUpgrade cluster-md-kmp-rtUpgrade kernel-default-baseUpgrade kernel-zfcpdumpUpgrade kernel-64kbUpgrade reiserfs-kmp-rtUpgrade kernel-debugUpgrade dtb-marvellUpgrade dtb-lgUpgrade dlm-kmp-defaultUpgrade dtb-broadcomUpgrade cluster-md-kmp-azureUpgrade gfs2-kmp-64kbUpgrade dtb-xilinxUpgrade kernel-docsUpgrade kernel-debug-develUpgrade ocfs2-kmp-rtUpgrade dtb-caviumUpgrade gfs2-kmp-defaultUpgrade kernel-source-azureUpgrade ocfs2-kmp-azureUpgrade kernel-default-livepatch-develUpgrade kernel-64kb-livepatch-develUpgrade dtb-allwinnerUpgrade kselftests-kmp-rtUpgrade kernel-symsUpgrade kselftests-kmp-azureUpgrade kernel-rt-optionalUpgrade kernel-azure-livepatch-develUpgrade kernel-debug-livepatch-develUpgrade kernel-source-rtUpgrade cluster-md-kmp-64kbUpgrade dlm-kmp-rtUpgrade reiserfs-kmp-azureUpgrade kernel-debug-vdsoUpgrade kernel-rt_debug-develUpgrade kernel-azure-develUpgrade dtb-rockchipUpgrade dtb-alteraUpgrade kernel-rt_debug-vdsoUpgrade reiserfs-kmp-64kbUpgrade kernel-azure-vdsoUpgrade kernel-azureUpgrade dtb-sprdUpgrade dtb-qcomUpgrade kernel-syms-azureUpgrade kernel-rt-livepatch-develUpgrade kernel-syms-rtUpgrade kernel-default-extraUpgrade gfs2-kmp-rtUpgrade kernel-rt-livepatchUpgrade kernel-macrosUpgrade kernel-kvmsmall-vdsoUpgrade kernel-devel-azureUpgrade dtb-nvidiaUpgrade kernel-kvmsmallUpgrade kernel-sourceUpgrade cluster-md-kmp-defaultUpgrade kernel-source-vanillaUpgrade kernel-rt-vdsoUpgrade kernel-defaultUpgrade dtb-exynosUpgrade dlm-kmp-64kbUpgrade dtb-armUpgrade kernel-rtUpgrade kernel-obs-buildUpgrade dtb-amlogicUpgrade kselftests-kmp-64kbUpgrade kernel-rt-extraUpgrade kernel-obs-qaUpgrade kernel-default-vdsoUpgrade kernel-default-base-rebuild | Jul 23, 2024 | Jun 25, 2024 |
| Ubuntu | — | Upgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-oracle-64kUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-awsUpgrade linux-image-5.15.0-1070-kvmUpgrade linux-image-oem-20.04cUpgrade linux-image-gcpUpgrade linux-image-oem-20.04dUpgrade linux-image-5.15.0-1068-nvidiaUpgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-5.15.0-127-lowlatency-64kUpgrade linux-image-6.8.0-44-generic-64kUpgrade linux-image-6.8.0-1011-raspiUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-oem-22.04cUpgrade linux-image-raspiUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-6.8.0-1014-azure-fdeUpgrade linux-image-gkeop-5.15Upgrade linux-image-6.8.0-1013-nvidia-64kUpgrade linux-image-generic-hwe-20.04Upgrade linux-image-5.15.0-1071-oracleUpgrade linux-image-6.8.0-1013-nvidia-lowlatencyUpgrade linux-image-virtual-hwe-20.04Upgrade linux-image-virtual-hwe-24.04Upgrade linux-image-5.15.0-127-generic-64kUpgrade linux-image-azure-cvmUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-virtual-hwe-22.04Upgrade linux-image-5.15.0-1066-raspiUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-5.15.0-127-genericUpgrade linux-image-oem-22.04dUpgrade linux-image-5.15.0-1078-azureUpgrade linux-image-oracle-lts-22.04Upgrade linux-image-nvidia-64kUpgrade linux-image-6.8.0-1014-gcpUpgrade linux-image-azure-fdeUpgrade linux-image-oem-22.04bUpgrade linux-image-azureUpgrade linux-image-kvmUpgrade linux-image-5.15.0-127-lowlatencyUpgrade linux-image-ibmUpgrade linux-image-6.8.0-1012-oracleUpgrade linux-image-6.8.0-44-lowlatencyUpgrade linux-image-5.15.0-1071-intel-iotgUpgrade linux-image-6.8.0-1012-ibmUpgrade linux-image-nvidia-6.8Upgrade linux-image-gke-5.15Upgrade linux-image-gkeUpgrade linux-image-6.8.0-45-generic-64kUpgrade linux-image-gkeopUpgrade linux-image-generic-64kUpgrade linux-image-6.8.0-1013-nvidiaUpgrade linux-image-5.15.0-1072-gcpUpgrade linux-image-5.15.0-1066-ibmUpgrade linux-image-azure-lts-22.04Upgrade linux-image-6.8.0-44-lowlatency-64kUpgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-aws-lts-22.04Upgrade linux-image-5.15.0-1073-awsUpgrade linux-image-oem-22.04aUpgrade linux-image-6.8.0-1010-gkeUpgrade linux-image-5.15.0-1039-xilinx-zynqmpUpgrade linux-image-5.15.0-1056-gkeopUpgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-6.8.0-45-genericUpgrade linux-image-6.8.0-1015-awsUpgrade linux-image-intelUpgrade linux-image-5.15.0-127-generic-lpaeUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-gcp-lts-22.04Upgrade linux-image-5.15.0-1070-gkeUpgrade linux-image-nvidiaUpgrade linux-image-ibm-classicUpgrade linux-image-6.8.0-1012-oracle-64kUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-intel-iotgUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-oem-20.04Upgrade linux-image-generic-lpaeUpgrade linux-image-lowlatencyUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-virtualUpgrade linux-image-6.8.0-44-genericUpgrade linux-image-6.8.0-1013-nvidia-lowlatency-64kUpgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-oem-22.04Upgrade linux-image-lowlatency-64kUpgrade linux-image-oracleUpgrade linux-image-raspi-nolpaeUpgrade linux-image-5.15.0-1068-nvidia-lowlatencyUpgrade linux-image-oem-20.04bUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-6.8.0-1012-oemUpgrade linux-image-genericUpgrade linux-image-6.8.0-1014-azure | Sep 12, 2024 | Jun 25, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 14, 2025 | Jun 25, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub