Use-After-Free Vulnerability in Linux Kernel's pNFS Handling

CVE-2026-63800

What is CVE-2026-63800?

A vulnerability in the Linux kernel's pNFS component was identified, specifically related to the error handling process. This issue arises when the system reaches the NFS_LAYOUT_RETURN branch in the pnfs_update_layout function. During the operation, the function pnfs_prepare_to_retry_layoutget is called, and if it completes successfully, the subsequent call to pnfs_put_layout_hdr occurs before the associated tracepoint (trace_pnfs_update_layout) is executed. This sequence leads to a use-after-free situation, wherein the tracepoint may access fields of the layout header that have already been deallocated, potentially compromising system stability and data integrity.

References