CVE-2026-63800: pNFS: Fix use-after-free in pnfs_update_layout()
In the Linux kernel, the following vulnerability has been resolved:
pNFS: Fix use-after-free in pnfsupdatelayout()
When hitting the NFSLAYOUTRETURN branch in pnfsupdatelayout(), the code calls pnfspreparetoretrylayoutget(lo). If it succeeds, pnfsputlayouthdr(lo) is called before tracepnfsupdatelayout(), which still references 'lo'. This results in a use-after-free when the tracepoint accesses lo's fields.
Fix this by moving the tracepoint call before pnfsputlayouthdr(lo).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.150.1-1 - Configuration
In the pnfs_update_layout() Linux kernel code path (NFS_LAYOUT_RETURN branch), fix the use-after-free by moving the tracepoint call trace_pnfs_update_layout() before pnfs_put_layout_hdr(lo). If pnfs_put_layout_hdr(lo) succeeds, ensure the subsequent pnfs_prepare_to_retry_layoutget(lo) occurs while trace_pnfs_update_layout(lo) still has valid lo references (since the tracepoint accesses lo's fields).
Linux kernel (pnfs_update_layout) trace_pnfs_update_layout() call order relative to pnfs_put_layout_hdr(lo) and pnfs_prepare_to_retry_layoutget(lo) = Move trace_pnfs_update_layout() before pnfs_put_layout_hdr(lo) (and ensure pnfs_prepare_to_retry_layoutget(lo) does not run after lo is freed)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-63800?
CVE-2026-63800 has a critical severity score of 9.8 according to the CVSS 3.1 metrics.
How do I fix CVE-2026-63800?
To fix CVE-2026-63800, you should update your Linux Kernel to the latest version that includes the patch for this vulnerability.
What type of vulnerability is CVE-2026-63800?
CVE-2026-63800 is classified as a use-after-free vulnerability affecting the pNFS subsystem in the Linux Kernel.
What impact does CVE-2026-63800 have?
CVE-2026-63800 can lead to potential data corruption, crashes, or arbitrary code execution due to improper memory management.
When was CVE-2026-63800 published?
CVE-2026-63800 was published on July 19, 2026.