Answer in brief
CVE-2024-39463 records a High severity (CVSS 7.8) vulnerability in 9p: add missing locking around taking dentry fid list. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic), linux/linux_kernel (generic), linux/linux_kernel (generic) and additional mapped packages. Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic), linux/linux_kernel (generic), linux/linux_kernel (generic) and additional mapped packages. Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=154372e67d4053e56591245eb413686621941333 <3bb6763a8319170c2d41c4232c8e7e4c37dcacfb || >=154372e67d4053e56591245eb413686621941333 <cb299cdba09f46f090b843d78ba26b667d50a456 || >=154372e67d4053e56591245eb413686621941333 <f0c5c944c6d8614c19e6e9a97fd2011dcd30e8f5 || >=154372e67d4053e56591245eb413686621941333 <fe17ebf22feb4ad7094d597526d558a49aac92b4 || >=154372e67d4053e56591245eb413686621941333 <c898afdc15645efb555acb6d85b484eb40a45409 | 3bb6763a8319170c2d41c4232c8e7e4c37dcacfb, cb299cdba09f46f090b843d78ba26b667d50a456, f0c5c944c6d8614c19e6e9a97fd2011dcd30e8f5, fe17ebf22feb4ad7094d597526d558a49aac92b4, c898afdc15645efb555acb6d85b484eb40a45409 |
| Linux/Linuxgeneric | 5.11 | Not reported |
| linux/linux_kernelgeneric | 5.11 | Not reported |
| linux/linux_kernelgeneric | * | Not reported |
| linux/linux_kernelgeneric | >=154372e67d40 <cb299cdba09f || >=154372e67d40 <f0c5c944c6d8 || >=154372e67d40 <fe17ebf22feb || >=154372e67d40 <c898afdc1564 | cb299cdba09f, f0c5c944c6d8, fe17ebf22feb, c898afdc1564 |
Published upstream
Jun 25, 2024
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: 9p: add missing locking around taking dentry fid list Fix a use-after-free on dentry's d_fsdata fid list when a thread looks up a fid through dentry while another thread unlinks it: UAF thread: refcount_t: addition on 0; use-after-free. p9_fid_get linux/./include/net/9p/client.h:262 v9fs_fid_find+0x236/0x280 linux/fs/9p/fid.c:129 v9fs_fid_lookup_with_uid linux/fs/9p/fid.c:181 v9fs_fid_lookup+0xbf/0xc20 linux/fs/9p/fid.c:314 v9fs_vfs_getattr_dotl+0xf9/0x360 linux/fs/9p/vfs_inode_dotl.c:400 vfs_statx+0xdd/0x4d0 linux/fs/stat.c:248 Freed by: p9_fid_destroy (inlined) p9_client_clunk+0xb0/0xe0 linux/net/9p/client.c:1456 p9_fid_put linux/./include/net/9p/client.h:278 v9fs_dentry_release+0xb5/0x140 linux/fs/9p/vfs_dentry.c:55 v9fs_remove+0x38f/0x620 linux/fs/9p/vfs_inode.c:518 vfs_unlink+0x29a/0x810 linux/fs/namei.c:4335 The problem is that d_fsdata was not accessed under d_lock, because d_release() normally is only called once the dentry is otherwise no longer accessible but since we also call it explicitly in v9fs_remove that lock is required: move the hlist out of the dentry under lock then unref its fids once they are no longer accessible.
Quoted source text, attributed separately from HOL analysis.