01 Record

CVE-2026-63795

9p: avoid putting oldfid in p9_client_walk() error path

CriticalPUBLISHEDCNA: Linux

CNA base score10.0 CVSS v3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

View raw JSON

02 Description

9p: avoid putting oldfid in p9_client_walk() error path

03 Exploitation and scoring

Exploitation

Assessed, none found. CISA's assessment recorded neither public exploit code nor evidence of exploitation when it was made.

SSVC decision

ExploitationnoneCISA recorded no public exploit code and no evidence of exploitation.
AutomatableyesAn attacker can reliably automate reconnaissance through exploitation, so this scales.
Technical ImpacttotalSuccessful exploitation gives total control of the vulnerable component.

CISA publishes the decision points, not a final SSVC decision. The decision also depends on mission and well-being impact, which is a property of your deployment rather than of the vulnerability.

EPSS probability

0.61% probability of exploitation activity in the next 30 days.

EPSS percentile

Equal to or higher than the score of 49.1% of scored records. A rank, not a probability.

NVD base score

10.0 (CVSS v3.x), scored by the NVD independently of the CNA.

NVD CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

NVD analysis status

Modified. NVD last modified this record on 2026-10-19.

Red Hat severity

Important. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2026-07-19 12:02Z3 MO AGO

Last updated

2026-10-19 20:07Z10 DAYS AGO

Reserved

2026-07-19

Assigning CNA

Linux

Record state

PUBLISHED

Severity

Critical (CVSS 10.0)

CNA CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weaknesses

CWE-416Use After FreeVariant
CWE-825Expired Pointer DereferenceBase

Data version

5.2

Document digest

a75ec17caef3dc0fbba19738e0a4be644003cc4f71aec410111bcf68d0013952

05 Affected products

VendorProductVersionsPlatforms

LinuxLinuxb48dbb998d70b7f48c2ec0a15c3cf47136808e4e to < 99c379ca1e221c3d75c7c804ebbf4e5ee37a3070, b48dbb998d70b7f48c2ec0a15c3cf47136808e4e to < b84f46179c806450b89821221ea5bd9a1698aba8, b48dbb998d70b7f48c2ec0a15c3cf47136808e4e to < a61bdcba4f64c2f90d01461913f429ab151f1ca6, b48dbb998d70b7f48c2ec0a15c3cf47136808e4e to < 6dbe9443d9f5f7fb6d319a7b77108853ae6c6bea, b48dbb998d70b7f48c2ec0a15c3cf47136808e4e to < a7656d368265d085ac9bb85ab31b0cdb72ad8c38, b48dbb998d70b7f48c2ec0a15c3cf47136808e4e to < 1a3860d46e3eb47dbd60339783cdad7904486b9f, 6.0—

06 References

git.kernel.orghttps://git.kernel.org/stable/c/99c379ca1e221c3d75c7c804ebbf4e5ee37a3070
git.kernel.orghttps://git.kernel.org/stable/c/b84f46179c806450b89821221ea5bd9a1698aba8
git.kernel.orghttps://git.kernel.org/stable/c/a61bdcba4f64c2f90d01461913f429ab151f1ca6
git.kernel.orghttps://git.kernel.org/stable/c/6dbe9443d9f5f7fb6d319a7b77108853ae6c6bea
git.kernel.orghttps://git.kernel.org/stable/c/a7656d368265d085ac9bb85ab31b0cdb72ad8c38
git.kernel.orghttps://git.kernel.org/stable/c/1a3860d46e3eb47dbd60339783cdad7904486b9f

07 Fixed in

Debian 12

linux
Fixed in 6.1.177-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 13

linux
Fixed in 6.12.95-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 14

linux
Fixed in 7.1.3-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.