CVE-2026-63795

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> 9p: avoid putting oldfid in p9_client_walk() error path<br /> <br /> When p9_client_walk() is called with clone set to false, fid aliases<br /> oldfid. If the walk subsequently fails after the request has been sent,<br /> the error path jumps to clunk_fid, which currently calls p9_fid_put(fid)<br /> unconditionally.<br /> <br /> This drops a reference to oldfid even though ownership of oldfid remains<br /> with the caller. If this is the last reference, oldfid can be clunked and<br /> destroyed while the caller still expects it to be valid. A later use or<br /> put of oldfid can then trigger a use-after-free or refcount underflow.<br /> <br /> Fix this by only putting fid in the clunk_fid error path when it does not<br /> alias oldfid, matching the existing guard in the error path below.<br /> <br /> This can be triggered when a multi-component walk is split into multiple<br /> p9_client_walk() calls and a later non-cloning walk fails. A reproducer<br /> and refcount warning logs are available on request.