CVE-2024-39463 (GCVE-0-2024-39463)

Vulnerability from cvelistv5 – Published: 2024-06-25 14:25 – Updated: 2026-08-05 11:33
VLAI
Title
9p: add missing locking around taking dentry fid list
Summary
In the Linux kernel, the following vulnerability has been resolved: 9p: add missing locking around taking dentry fid list Fix a use-after-free on dentry's d_fsdata fid list when a thread looks up a fid through dentry while another thread unlinks it: UAF thread: refcount_t: addition on 0; use-after-free. p9_fid_get linux/./include/net/9p/client.h:262 v9fs_fid_find+0x236/0x280 linux/fs/9p/fid.c:129 v9fs_fid_lookup_with_uid linux/fs/9p/fid.c:181 v9fs_fid_lookup+0xbf/0xc20 linux/fs/9p/fid.c:314 v9fs_vfs_getattr_dotl+0xf9/0x360 linux/fs/9p/vfs_inode_dotl.c:400 vfs_statx+0xdd/0x4d0 linux/fs/stat.c:248 Freed by: p9_fid_destroy (inlined) p9_client_clunk+0xb0/0xe0 linux/net/9p/client.c:1456 p9_fid_put linux/./include/net/9p/client.h:278 v9fs_dentry_release+0xb5/0x140 linux/fs/9p/vfs_dentry.c:55 v9fs_remove+0x38f/0x620 linux/fs/9p/vfs_inode.c:518 vfs_unlink+0x29a/0x810 linux/fs/namei.c:4335 The problem is that d_fsdata was not accessed under d_lock, because d_release() normally is only called once the dentry is otherwise no longer accessible but since we also call it explicitly in v9fs_remove that lock is required: move the hlist out of the dentry under lock then unref its fids once they are no longer accessible.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 154372e67d4053e56591245eb413686621941333 , < 3bb6763a8319170c2d41c4232c8e7e4c37dcacfb (git)
Affected: 154372e67d4053e56591245eb413686621941333 , < cb299cdba09f46f090b843d78ba26b667d50a456 (git)
Affected: 154372e67d4053e56591245eb413686621941333 , < f0c5c944c6d8614c19e6e9a97fd2011dcd30e8f5 (git)
Affected: 154372e67d4053e56591245eb413686621941333 , < fe17ebf22feb4ad7094d597526d558a49aac92b4 (git)
Affected: 154372e67d4053e56591245eb413686621941333 , < c898afdc15645efb555acb6d85b484eb40a45409 (git)
Create a notification for this product.
Linux Linux Affected: 5.11
Unaffected: 0 , < 5.11 (semver)
Unaffected: 5.15.168 , ≤ 5.15.* (semver)
Unaffected: 6.1.94 , ≤ 6.1.* (semver)
Unaffected: 6.6.34 , ≤ 6.6.* (semver)
Unaffected: 6.9.5 , ≤ 6.9.* (semver)
Unaffected: 6.10 , ≤ * (original_commit_for_fix)
Create a notification for this product.
linux linux_kernel Affected: 5.11
    cpe:2.3:o:linux:linux_kernel:5.11:*:*:*:*:*:*:*
 Create a notification for this product.
linux linux_kernel Affected: 154372e67d40 , < cb299cdba09f (custom)
Affected: 154372e67d40 , < f0c5c944c6d8 (custom)
Affected: 154372e67d40 , < fe17ebf22feb (custom)
Affected: 154372e67d40 , < c898afdc1564 (custom)
    cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
 Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T04:26:15.245Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/cb299cdba09f46f090b843d78ba26b667d50a456"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/f0c5c944c6d8614c19e6e9a97fd2011dcd30e8f5"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/fe17ebf22feb4ad7094d597526d558a49aac92b4"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/c898afdc15645efb555acb6d85b484eb40a45409"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:5.11:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "affected",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "status": "affected",
                "version": "5.11"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "cb299cdba09f",
                "status": "affected",
                "version": "154372e67d40",
                "versionType": "custom"
              },
              {
                "lessThan": "f0c5c944c6d8",
                "status": "affected",
                "version": "154372e67d40",
                "versionType": "custom"
              },
              {
                "lessThan": "fe17ebf22feb",
                "status": "affected",
                "version": "154372e67d40",
                "versionType": "custom"
              },
              {
                "lessThan": "c898afdc1564",
                "status": "affected",
                "version": "154372e67d40",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-39463",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T03:55:21.281977Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-10T15:36:18.860Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/9p/vfs_dentry.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3bb6763a8319170c2d41c4232c8e7e4c37dcacfb",
              "status": "affected",
              "version": "154372e67d4053e56591245eb413686621941333",
              "versionType": "git"
            },
            {
              "lessThan": "cb299cdba09f46f090b843d78ba26b667d50a456",
              "status": "affected",
              "version": "154372e67d4053e56591245eb413686621941333",
              "versionType": "git"
            },
            {
              "lessThan": "f0c5c944c6d8614c19e6e9a97fd2011dcd30e8f5",
              "status": "affected",
              "version": "154372e67d4053e56591245eb413686621941333",
              "versionType": "git"
            },
            {
              "lessThan": "fe17ebf22feb4ad7094d597526d558a49aac92b4",
              "status": "affected",
              "version": "154372e67d4053e56591245eb413686621941333",
              "versionType": "git"
            },
            {
              "lessThan": "c898afdc15645efb555acb6d85b484eb40a45409",
              "status": "affected",
              "version": "154372e67d4053e56591245eb413686621941333",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/9p/vfs_dentry.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.11"
            },
            {
              "lessThan": "5.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.168",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.94",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.34",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.168",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.94",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.34",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9.5",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\n9p: add missing locking around taking dentry fid list\n\nFix a use-after-free on dentry\u0027s d_fsdata fid list when a thread\nlooks up a fid through dentry while another thread unlinks it:\n\nUAF thread:\nrefcount_t: addition on 0; use-after-free.\n p9_fid_get linux/./include/net/9p/client.h:262\n v9fs_fid_find+0x236/0x280 linux/fs/9p/fid.c:129\n v9fs_fid_lookup_with_uid linux/fs/9p/fid.c:181\n v9fs_fid_lookup+0xbf/0xc20 linux/fs/9p/fid.c:314\n v9fs_vfs_getattr_dotl+0xf9/0x360 linux/fs/9p/vfs_inode_dotl.c:400\n vfs_statx+0xdd/0x4d0 linux/fs/stat.c:248\n\nFreed by:\n p9_fid_destroy (inlined)\n p9_client_clunk+0xb0/0xe0 linux/net/9p/client.c:1456\n p9_fid_put linux/./include/net/9p/client.h:278\n v9fs_dentry_release+0xb5/0x140 linux/fs/9p/vfs_dentry.c:55\n v9fs_remove+0x38f/0x620 linux/fs/9p/vfs_inode.c:518\n vfs_unlink+0x29a/0x810 linux/fs/namei.c:4335\n\nThe problem is that d_fsdata was not accessed under d_lock, because\nd_release() normally is only called once the dentry is otherwise no\nlonger accessible but since we also call it explicitly in v9fs_remove\nthat lock is required:\nmove the hlist out of the dentry under lock then unref its fids once\nthey are no longer accessible."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The race is triggered entirely through local syscalls (`statx()`/`getxattr()` and `unlink()`) issued against a mounted 9p filesystem; no network peer input is required to reach the vulnerable code.\nAC:L - The attacker controls both sides of the race by running two threads (one looping statx, one looping unlink) on the same path, and the window is exceptionally wide because the freed fid remains linked in `d_fsdata` for the entire blocking TCLUNK RPC round-trip; nothing in VFS serializes statx against vfs_unlink.\nPR:L - An unprivileged local user with access to an existing 9p mount (QEMU virtfs share, WSL2, Crostini, Kata/LXD VM guests) can trigger this \u2014 both statx and unlink are unprivileged operations needing only write permission on a directory the user already owns.\nUI:N - The attacker performs both racing operations themselves; no victim action is required, as the 9p mount is a pre-existing deployment property rather than an action induced from a user.\nS:U - The use-after-free corrupts kernel heap memory within the same kernel security authority; it yields local kernel privilege escalation, not a crossing of a VM/IOMMU boundary.\nC:H - The dangling `struct p9_fid` comes from a general kmalloc slab and is dereferenced after free (`fid-\u003eclnt`, `fid-\u003efid`), so heap reclamation gives the attacker a read primitive over adjacent/reclaimed kernel objects and disclosure of kernel pointers.\nI:H - The UAF provides refcount writes into freed memory, a controlled `fid-\u003eclnt` pointer dereference used for spinlock/`idr_remove()` operations, a `kfree(fid-\u003erdir)` arbitrary-free, and a double free \u2014 a classic path to arbitrary write and control-flow hijack.\nA:H - Even unweaponized, the bug produces a `refcount_t: addition on 0` splat, slab corruption, and kernel oops/panic, and can be triggered repeatedly by any local user with access to the mount."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:33:24.281Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3bb6763a8319170c2d41c4232c8e7e4c37dcacfb"
        },
        {
          "url": "https://git.kernel.org/stable/c/cb299cdba09f46f090b843d78ba26b667d50a456"
        },
        {
          "url": "https://git.kernel.org/stable/c/f0c5c944c6d8614c19e6e9a97fd2011dcd30e8f5"
        },
        {
          "url": "https://git.kernel.org/stable/c/fe17ebf22feb4ad7094d597526d558a49aac92b4"
        },
        {
          "url": "https://git.kernel.org/stable/c/c898afdc15645efb555acb6d85b484eb40a45409"
        },
        {
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-24-1194/"
        }
      ],
      "title": "9p: add missing locking around taking dentry fid list",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-39463",
    "datePublished": "2024-06-25T14:25:02.887Z",
    "dateReserved": "2024-06-25T14:23:23.744Z",
    "dateUpdated": "2026-08-05T11:33:24.281Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-39463",
      "date": "2026-08-07",
      "epss": "0.00253",
      "percentile": "0.16707"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-18T14:46:35.000Z",
      "cve": "CVE-2024-39463",
      "id": "msrc_CVE-2024-39463",
      "initial_release_date": "2024-06-02T07:00:00.000Z",
      "product_status:fixed": "3",
      "product_status:known_affected": "3",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "9p: add missing locking around taking dentry fid list",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-39463.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-39463\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-06-25T15:15:14.760\",\"lastModified\":\"2026-06-17T07:41:57.930\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\n9p: add missing locking around taking dentry fid list\\n\\nFix a use-after-free on dentry\u0027s d_fsdata fid list when a thread\\nlooks up a fid through dentry while another thread unlinks it:\\n\\nUAF thread:\\nrefcount_t: addition on 0; use-after-free.\\n p9_fid_get linux/./include/net/9p/client.h:262\\n v9fs_fid_find+0x236/0x280 linux/fs/9p/fid.c:129\\n v9fs_fid_lookup_with_uid linux/fs/9p/fid.c:181\\n v9fs_fid_lookup+0xbf/0xc20 linux/fs/9p/fid.c:314\\n v9fs_vfs_getattr_dotl+0xf9/0x360 linux/fs/9p/vfs_inode_dotl.c:400\\n vfs_statx+0xdd/0x4d0 linux/fs/stat.c:248\\n\\nFreed by:\\n p9_fid_destroy (inlined)\\n p9_client_clunk+0xb0/0xe0 linux/net/9p/client.c:1456\\n p9_fid_put linux/./include/net/9p/client.h:278\\n v9fs_dentry_release+0xb5/0x140 linux/fs/9p/vfs_dentry.c:55\\n v9fs_remove+0x38f/0x620 linux/fs/9p/vfs_inode.c:518\\n vfs_unlink+0x29a/0x810 linux/fs/namei.c:4335\\n\\nThe problem is that d_fsdata was not accessed under d_lock, because\\nd_release() normally is only called once the dentry is otherwise no\\nlonger accessible but since we also call it explicitly in v9fs_remove\\nthat lock is required:\\nmove the hlist out of the dentry under lock then unref its fids once\\nthey are no longer accessible.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: 9p: agregar bloqueo faltante al tomar la lista de fid de dentry. Se corrigi\u00f3 un use-after-free en la lista de fid d_fsdata de dentry cuando un subproceso busca un fid a trav\u00e9s de dentry mientras otro subproceso lo desvincula: UAF hilo: refcount_t: suma en 0; use-after-free. p9_fid_get linux/./include/net/9p/client.h:262 v9fs_fid_find+0x236/0x280 linux/fs/9p/fid.c:129 v9fs_fid_lookup_with_uid linux/fs/9p/fid.c:181 v9fs_fid_lookup+0xbf/0xc20 Linux /fs/9p/fid.c:314 v9fs_vfs_getattr_dotl+0xf9/0x360 linux/fs/9p/vfs_inode_dotl.c:400 vfs_statx+0xdd/0x4d0 linux/fs/stat.c:248 Liberado por: p9_fid_destroy (en l\u00ednea) desconocido+0xb0 /0xe0 linux/net/9p/client.c:1456 p9_fid_put linux/./include/net/9p/client.h:278 v9fs_dentry_release+0xb5/0x140 linux/fs/9p/vfs_dentry.c:55 v9fs_remove+0x38f/0x620 linux/fs/9p/vfs_inode.c:518 vfs_unlink+0x29a/0x810 linux/fs/namei.c:4335 El problema es que no se accedi\u00f3 a d_fsdata bajo d_lock, porque normalmente d_release() solo se llama una vez que dentry no est\u00e1 disponible. ya no es accesible, pero como tambi\u00e9n lo llamamos expl\u00edcitamente en v9fs_remove, ese bloqueo es necesario: mueva la hlist fuera del dentry bajo bloqueo y luego elimine la referencia de sus fids una vez que ya no sean accesibles.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/9p/vfs_dentry.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"154372e67d4053e56591245eb413686621941333\",\"lessThan\":\"3bb6763a8319170c2d41c4232c8e7e4c37dcacfb\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"154372e67d4053e56591245eb413686621941333\",\"lessThan\":\"cb299cdba09f46f090b843d78ba26b667d50a456\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"154372e67d4053e56591245eb413686621941333\",\"lessThan\":\"f0c5c944c6d8614c19e6e9a97fd2011dcd30e8f5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"154372e67d4053e56591245eb413686621941333\",\"lessThan\":\"fe17ebf22feb4ad7094d597526d558a49aac92b4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"154372e67d4053e56591245eb413686621941333\",\"lessThan\":\"c898afdc15645efb555acb6d85b484eb40a45409\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/9p/vfs_dentry.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.11\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.11\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.168\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.94\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.34\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.9.5\",\"lessThanOrEqual\":\"6.9.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"affectedData\":[{\"vendor\":\"linux\",\"product\":\"linux_kernel\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:2.3:o:linux:linux_kernel:5.11:*:*:*:*:*:*:*\"],\"versions\":[{\"version\":\"5.11\",\"status\":\"affected\"}]},{\"vendor\":\"linux\",\"product\":\"linux_kernel\",\"defaultStatus\":\"unaffected\",\"cpes\":[\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\"],\"versions\":[{\"version\":\"154372e67d40\",\"lessThan\":\"cb299cdba09f\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"154372e67d40\",\"lessThan\":\"f0c5c944c6d8\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"154372e67d40\",\"lessThan\":\"fe17ebf22feb\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"154372e67d40\",\"lessThan\":\"c898afdc1564\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-10T03:55:21.281977Z\",\"id\":\"CVE-2024-39463\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.168\",\"matchCriteriaId\":\"4D51C05D-455B-4D8D-89E7-A58E140B864C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.94\",\"matchCriteriaId\":\"9D20DE32-76F8-4E4C-A8DF-5B53082D18E5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.34\",\"matchCriteriaId\":\"6BD9DCFD-0342-4039-B8CE-70F26DB7173B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.9.5\",\"matchCriteriaId\":\"8366481F-770F-4850-9D0F-2977BD97D5C5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.10:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"2EBB4392-5FA6-4DA9-9772-8F9C750109FA\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/3bb6763a8319170c2d41c4232c8e7e4c37dcacfb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c898afdc15645efb555acb6d85b484eb40a45409\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/cb299cdba09f46f090b843d78ba26b667d50a456\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f0c5c944c6d8614c19e6e9a97fd2011dcd30e8f5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/fe17ebf22feb4ad7094d597526d558a49aac92b4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://www.zerodayinitiative.com/advisories/ZDI-24-1194/\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://git.kernel.org/stable/c/c898afdc15645efb555acb6d85b484eb40a45409\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/cb299cdba09f46f090b843d78ba26b667d50a456\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f0c5c944c6d8614c19e6e9a97fd2011dcd30e8f5\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/fe17ebf22feb4ad7094d597526d558a49aac92b4\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-02-02T10:56:24+00:00",
      "cve": "CVE-2024-39463",
      "id": "CVE-2024-39463",
      "initial_release_date": "2024-06-25T00:00:00+00:00",
      "product_status:known_affected": "14",
      "product_status:known_not_affected": "184",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: 9p: add missing locking around taking dentry fid list",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-39463.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/cb299cdba09f46f090b843d78ba26b667d50a456\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/f0c5c944c6d8614c19e6e9a97fd2011dcd30e8f5\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/fe17ebf22feb4ad7094d597526d558a49aac92b4\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/c898afdc15645efb555acb6d85b484eb40a45409\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T04:26:15.245Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.8, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-39463\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T03:55:21.281977Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:o:linux:linux_kernel:5.11:*:*:*:*:*:*:*\"], \"vendor\": \"linux\", \"product\": \"linux_kernel\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.11\"}], \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\"], \"vendor\": \"linux\", \"product\": \"linux_kernel\", \"versions\": [{\"status\": \"affected\", \"version\": \"154372e67d40\", \"lessThan\": \"cb299cdba09f\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"154372e67d40\", \"lessThan\": \"f0c5c944c6d8\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"154372e67d40\", \"lessThan\": \"fe17ebf22feb\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"154372e67d40\", \"lessThan\": \"c898afdc1564\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-416\", \"description\": \"CWE-416 Use After Free\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-10T15:33:58.445Z\"}}], \"cna\": {\"title\": \"9p: add missing locking around taking dentry fid list\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"154372e67d4053e56591245eb413686621941333\", \"lessThan\": \"3bb6763a8319170c2d41c4232c8e7e4c37dcacfb\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"154372e67d4053e56591245eb413686621941333\", \"lessThan\": \"cb299cdba09f46f090b843d78ba26b667d50a456\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"154372e67d4053e56591245eb413686621941333\", \"lessThan\": \"f0c5c944c6d8614c19e6e9a97fd2011dcd30e8f5\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"154372e67d4053e56591245eb413686621941333\", \"lessThan\": \"fe17ebf22feb4ad7094d597526d558a49aac92b4\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"154372e67d4053e56591245eb413686621941333\", \"lessThan\": \"c898afdc15645efb555acb6d85b484eb40a45409\", \"versionType\": \"git\"}], \"programFiles\": [\"fs/9p/vfs_dentry.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.11\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.11\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.15.168\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.94\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.34\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9.5\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.9.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"fs/9p/vfs_dentry.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/3bb6763a8319170c2d41c4232c8e7e4c37dcacfb\"}, {\"url\": \"https://git.kernel.org/stable/c/cb299cdba09f46f090b843d78ba26b667d50a456\"}, {\"url\": \"https://git.kernel.org/stable/c/f0c5c944c6d8614c19e6e9a97fd2011dcd30e8f5\"}, {\"url\": \"https://git.kernel.org/stable/c/fe17ebf22feb4ad7094d597526d558a49aac92b4\"}, {\"url\": \"https://git.kernel.org/stable/c/c898afdc15645efb555acb6d85b484eb40a45409\"}, {\"url\": \"https://www.zerodayinitiative.com/advisories/ZDI-24-1194/\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\n9p: add missing locking around taking dentry fid list\\n\\nFix a use-after-free on dentry\u0027s d_fsdata fid list when a thread\\nlooks up a fid through dentry while another thread unlinks it:\\n\\nUAF thread:\\nrefcount_t: addition on 0; use-after-free.\\n p9_fid_get linux/./include/net/9p/client.h:262\\n v9fs_fid_find+0x236/0x280 linux/fs/9p/fid.c:129\\n v9fs_fid_lookup_with_uid linux/fs/9p/fid.c:181\\n v9fs_fid_lookup+0xbf/0xc20 linux/fs/9p/fid.c:314\\n v9fs_vfs_getattr_dotl+0xf9/0x360 linux/fs/9p/vfs_inode_dotl.c:400\\n vfs_statx+0xdd/0x4d0 linux/fs/stat.c:248\\n\\nFreed by:\\n p9_fid_destroy (inlined)\\n p9_client_clunk+0xb0/0xe0 linux/net/9p/client.c:1456\\n p9_fid_put linux/./include/net/9p/client.h:278\\n v9fs_dentry_release+0xb5/0x140 linux/fs/9p/vfs_dentry.c:55\\n v9fs_remove+0x38f/0x620 linux/fs/9p/vfs_inode.c:518\\n vfs_unlink+0x29a/0x810 linux/fs/namei.c:4335\\n\\nThe problem is that d_fsdata was not accessed under d_lock, because\\nd_release() normally is only called once the dentry is otherwise no\\nlonger accessible but since we also call it explicitly in v9fs_remove\\nthat lock is required:\\nmove the hlist out of the dentry under lock then unref its fids once\\nthey are no longer accessible.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.168\", \"versionStartIncluding\": \"5.11\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.94\", \"versionStartIncluding\": \"5.11\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.34\", \"versionStartIncluding\": \"5.11\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9.5\", \"versionStartIncluding\": \"5.11\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10\", \"versionStartIncluding\": \"5.11\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-11T20:21:01.570Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-39463\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-11T20:21:01.570Z\", \"dateReserved\": \"2024-06-25T14:23:23.744Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-06-25T14:25:02.887Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.