In the Linux kernel, the following vulnerability has been resolved:
9p/xen: protect xen_9pfs_front_free against concurrent calls
The xenwatch thread can race with other back-end change notifications and call xen_9pfs_front_free() twice, hitting the observed general protection fault due to a double-free. Guard the teardown path so only one caller can release the front-end state at a time, preventing the crash.
This is a fix for the following double-free:
[ 27.052347] Oops: general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b6b6b: 0000 [#1] SMP DEBUG_PAGEALLOC NOPTI [ 27.052357] CPU: 0 UID: 0 PID: 32 Comm: xenwatch Not tainted 6.18.0-02087-g51ab33fc0a8b-dirty #60 PREEMPT(none) [ 27.052363] RIP: e030:xen_9pfs_front_free+0x1d/0x150 [ 27.052368] Code: 90 90 90 90 90 90 90 90 90 90 90 90 90 41 55 41 54 55 48 89 fd 48 c7 c7 48 d0 92 85 53 e8 cb cb 05 00 48 8b 45 08 48 8b 55 00 <48> 3b 28 0f 85 f9 28 35 fe 48 3b 6a 08 0f 85 ef 28 35 fe 48 89 42 [ 27.052377] RSP: e02b:ffffc9004016fdd0 EFLAGS: 00010246 [ 27.052381] RAX: 6b6b6b6b6b6b6b6b RBX: ffff88800d66e400 RCX: 0000000000000000 [ 27.052385] RDX: 6b6b6b6b6b6b6b6b RSI: 0000000000000000 RDI: 0000000000000000 [ 27.052389] RBP: ffff88800a887040 R08: 0000000000000000 R09: 0000000000000000 [ 27.052393] R10: 0000000000000000 R11: 0000000000000000 R12: ffff888009e46b68 [ 27.052397] R13: 0000000000000200 R14: 0000000000000000 R15: ffff88800a887040 [ 27.052404] FS: 0000000000000000(0000) GS:ffff88808ca57000(0000) knlGS:0000000000000000 [ 27.052408] CS: e030 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 27.052412] CR2: 00007f9714004360 CR3: 0000000004834000 CR4: 0000000000050660 [ 27.052418] Call Trace: [ 27.052420] <TASK> [ 27.052422] xen_9pfs_front_changed+0x5d5/0x720 [ 27.052426] ? xenbus_otherend_changed+0x72/0x140 [ 27.052430] ? __pfx_xenwatch_thread+0x10/0x10 [ 27.052434] xenwatch_thread+0x94/0x1c0 [ 27.052438] ? __pfx_autoremove_wake_function+0x10/0x10 [ 27.052442] kthread+0xf8/0x240 [ 27.052445] ? __pfx_kthread+0x10/0x10 [ 27.052449] ? __pfx_kthread+0x10/0x10 [ 27.052452] ret_from_fork+0x16b/0x1a0 [ 27.052456] ? __pfx_kthread+0x10/0x10 [ 27.052459] ret_from_fork_asm+0x1a/0x30 [ 27.052463] </TASK> [ 27.052465] Modules linked in: [ 27.052471] ---[ end trace 0000000000000000 ]---
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 23, 2026 | Jul 23, 2026 |
| Ubuntu | — | Upgrade linux-image-virtualUpgrade linux-image-raspi-realtimeUpgrade linux-image-xilinxUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-ibm-classicUpgrade linux-image-aws-64k-lts-24.04Upgrade linux-image-6.8.0-1058-gkeUpgrade linux-image-oem-20.04dUpgrade linux-image-generic-64k-6.8Upgrade linux-image-oracleUpgrade linux-image-oem-22.04bUpgrade linux-image-gke-64k-6.8Upgrade linux-image-nvidia-tegra-rt-6.8Upgrade linux-image-azure-lts-24.04Upgrade linux-image-ibm-6.8Upgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-ibm-lts-24.04Upgrade linux-image-virtual-hwe-22.04Upgrade linux-image-6.8.0-1063-gcp-64kUpgrade linux-image-6.8.0-134-lowlatencyUpgrade linux-image-6.8.0-1045-gkeopUpgrade linux-image-aws-64k-6.8Upgrade linux-image-realtime-hwe-22.04Upgrade linux-image-awsUpgrade linux-image-6.8.0-1063-azureUpgrade linux-image-aws-lts-24.04Upgrade linux-image-azure-fips-6.8Upgrade linux-image-fips-6.8Upgrade linux-image-nvidia-64kUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-kvmUpgrade linux-image-gcpUpgrade linux-image-6.8.1-1055-realtimeUpgrade linux-image-ibmUpgrade linux-image-xilinx-6.8Upgrade linux-image-gcp-6.8Upgrade linux-image-gcp-lts-24.04Upgrade linux-image-generic-6.8Upgrade linux-image-oracle-6.8Upgrade linux-image-gke-6.8Upgrade linux-image-6.8.0-1060-aws-fipsUpgrade linux-image-gkeop-6.8Upgrade linux-image-6.8.0-1058-nvidia-lowlatency-64kUpgrade linux-image-oracle-64kUpgrade linux-image-laptop-23.10Upgrade linux-image-6.8.0-136-genericUpgrade linux-image-azure-fde-lts-24.04Upgrade linux-image-realtimeUpgrade linux-image-azure-fipsUpgrade linux-image-6.8.0-1057-oracleUpgrade linux-image-azure-fdeUpgrade linux-image-aws-fips-6.8Upgrade linux-image-oem-22.04cUpgrade linux-image-6.8.0-1062-azure-fipsUpgrade linux-image-6.8.0-1029-nvidia-tegra-rtUpgrade linux-image-oem-20.04cUpgrade linux-image-oem-20.04Upgrade linux-image-intel-iotgUpgrade linux-image-gcp-fipsUpgrade linux-image-6.8.0-1060-awsUpgrade linux-image-oem-22.04Upgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-lowlatency-64k-6.8Upgrade linux-image-nvidia-lowlatency-6.8Upgrade linux-image-gcp-fips-6.8Upgrade linux-image-nvidia-tegra-6.8Upgrade linux-image-azure-6.8Upgrade linux-image-6.8.0-1058-nvidia-64kUpgrade linux-image-aws-fipsUpgrade linux-image-aws-64kUpgrade linux-image-6.8.0-134-lowlatency-64kUpgrade linux-image-6.8.0-1060-raspiUpgrade linux-image-6.8.0-1058-nvidiaUpgrade linux-image-raspiUpgrade linux-image-oem-20.04bUpgrade linux-image-nvidia-tegra-rtUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-gkeUpgrade linux-image-genericUpgrade linux-image-generic-lpaeUpgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-fipsUpgrade linux-image-6.8.0-1062-azure-fdeUpgrade linux-image-6.8.0-136-generic-64kUpgrade linux-image-gke-64kUpgrade linux-image-azure-fde-6.8Upgrade linux-image-azureUpgrade linux-image-6.8.0-134-genericUpgrade linux-image-6.8.0-134-generic-64kUpgrade linux-image-6.8.0-134-fipsUpgrade linux-image-6.8.0-1057-oracle-64kUpgrade linux-image-oem-22.04dUpgrade linux-image-oem-22.04aUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-lowlatency-64kUpgrade linux-image-6.8.0-2049-raspi-realtimeUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-lowlatency-6.8Upgrade linux-image-gkeopUpgrade linux-image-aws-6.8Upgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-gcp-64kUpgrade linux-image-6.8.0-1063-gcp-fipsUpgrade linux-image-raspi-realtime-6.8Upgrade linux-image-realtime-6.8.1Upgrade linux-image-nvidiaUpgrade linux-image-nvidia-6.8Upgrade linux-image-6.8.0-1032-xilinxUpgrade linux-image-oracle-lts-24.04Upgrade linux-image-nvidia-tegraUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-6.8.0-1060-ibmUpgrade linux-image-6.8.0-1060-aws-64kUpgrade linux-image-raspi-6.8Upgrade linux-image-xilinx-zynqmpUpgrade linux-image-nvidia-lowlatency-64k-6.8Upgrade linux-image-gcp-64k-6.8Upgrade linux-image-6.8.0-1063-gcpUpgrade linux-image-6.8.0-1058-nvidia-lowlatencyUpgrade linux-image-6.8.0-1058-gke-64kUpgrade linux-image-6.8.0-1029-nvidia-tegraUpgrade linux-image-virtual-6.8Upgrade linux-image-intel-iot-realtimeUpgrade linux-image-generic-64kUpgrade linux-image-lowlatencyUpgrade linux-image-oracle-64k-6.8 | Jul 2, 2026 | Jul 1, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jun 22, 2026 | May 6, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub