In the Linux kernel, the following vulnerability has been resolved:

pNFS: Fix use-after-free in pnfs_update_layout()

When hitting the NFS_LAYOUT_RETURN branch in pnfs_update_layout(),
the code calls pnfs_prepare_to_retry_layoutget(lo). If it succeeds,
pnfs_put_layout_hdr(lo) is called before trace_pnfs_update_layout(),
which still references 'lo'. This results in a use-after-free when the
tracepoint accesses lo's fields.

Fix this by moving the tracepoint call before pnfs_put_layout_hdr(lo).

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
06f58dbc49a23c99e5c0f246879ed16667f7bf8f affected < 4ad8b9a85dbf57ca532ee9e65ad7e6498bfbbf98
2c8d5fc37fe2384a9bdb6965443ab9224d46f704 affected < 1f24b8302c77dcaf79c64c073877a3b9f4dd25d2
2c8d5fc37fe2384a9bdb6965443ab9224d46f704 affected < 9c0fb5c09ae5bd68dc0038692af8127029cb0385
2c8d5fc37fe2384a9bdb6965443ab9224d46f704 affected < 7e37e9b3e82ade881e1798e2f4fcc54aff7793c1
2c8d5fc37fe2384a9bdb6965443ab9224d46f704 affected < 2883ddd7542b4437a2ab4908fe2773f690e20889
2c8d5fc37fe2384a9bdb6965443ab9224d46f704 affected < 200e7637f4d6a1342987045eea72641524f909dc
2c8d5fc37fe2384a9bdb6965443ab9224d46f704 affected < 9645aaf689aff57427ece3b9fa47d5b5399417f4
2c8d5fc37fe2384a9bdb6965443ab9224d46f704 affected < 13e198a90ca4050f4bee8a3f23680389a6563ccc
aa2399f55eff4ec78330bb6fe55f9df53e5cae0c affected —
5.10.9 affected < 5.10.260
5.4.91 affected < 5.5
Linux Linux affected
Version Status Constraints
5.11 affected —
0 unaffected < 5.11
5.10.260 unaffected ≤ 5.10.*
5.15.211 unaffected ≤ 5.15.*
6.1.177 unaffected ≤ 6.1.*
6.6.144 unaffected ≤ 6.6.*
6.12.95 unaffected ≤ 6.12.*
6.18.38 unaffected ≤ 6.18.*
7.1.3 unaffected ≤ 7.1.*
7.2-rc1 unaffected ≤ *

No data.

No data.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/13e198a90ca4050f4bee8a3f23680389a6563ccc cve-icon
https://git.kernel.org/stable/c/1f24b8302c77dcaf79c64c073877a3b9f4dd25d2 cve-icon
https://git.kernel.org/stable/c/200e7637f4d6a1342987045eea72641524f909dc cve-icon
https://git.kernel.org/stable/c/2883ddd7542b4437a2ab4908fe2773f690e20889 cve-icon
https://git.kernel.org/stable/c/4ad8b9a85dbf57ca532ee9e65ad7e6498bfbbf98 cve-icon
https://git.kernel.org/stable/c/7e37e9b3e82ade881e1798e2f4fcc54aff7793c1 cve-icon
https://git.kernel.org/stable/c/9645aaf689aff57427ece3b9fa47d5b5399417f4 cve-icon
https://git.kernel.org/stable/c/9c0fb5c09ae5bd68dc0038692af8127029cb0385 cve-icon
History

Sun, 19 Jul 2026 12:15:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: pNFS: Fix use-after-free in pnfs_update_layout() When hitting the NFS_LAYOUT_RETURN branch in pnfs_update_layout(), the code calls pnfs_prepare_to_retry_layoutget(lo). If it succeeds, pnfs_put_layout_hdr(lo) is called before trace_pnfs_update_layout(), which still references 'lo'. This results in a use-after-free when the tracepoint accesses lo's fields. Fix this by moving the tracepoint call before pnfs_put_layout_hdr(lo).
Title pNFS: Fix use-after-free in pnfs_update_layout()
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-07-19T12:02:06.897Z

Reserved: 2026-07-19T07:54:57.013Z

Link: CVE-2026-63800

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses

No weakness.