CVE-2026-63795

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the 9p filesystem implementation where the p9 client walk() function incorrectly handles file identifiers (fids) during error paths. When the function is called with the clone parameter set to false, the fid aliases oldfid. If the walk fails after the request is sent, the error path triggers clunk fid, which unconditionally calls p9 fid put(fid). This action drops a reference to oldfid while the caller still maintains ownership. If this is the final reference, oldfid may be destroyed, leading to a use-after-free condition or a refcount underflow when the caller subsequently attempts to use or release oldfid. This scenario typically occurs during multi-component walks split into multiple p9 client walk() calls where a later non-cloning walk fails.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.