CVE-2026-105517

A use-after-free vulnerability was found in the 9P protocol implementation of NFS-Ganesha. The server does not protect the lifetime of file identifier FID objects when processing concurrent requests. An attacker can race a write operation against a close operation on the same FID, causing one...

CVE-2026-105516

A stack buffer overflow vulnerability was found in the 9P protocol implementation of NFS-Ganesha. The server does not validate the number of path components in a TWALK request against the protocol-defined limit of 16. An attacker can send a specially crafted TWALK message with thousands of path...

ROS-20260925-73-0093

The vulnerability of the p9clientwalk function in the net/9p/client.c module of the 9P protocol implementation in the Linux operating system is related to the dereferencing of a pointer whose validity period has expired. Exploiting this vulnerability allows an attacker to compromise the...

UBUNTU-CVE-2026-72491

In the Linux kernel, the following vulnerability has been resolved: net/9p: fix race condition on rdma-state in transrdma.c The rdma-state field is modified without holding reqlock in both recvdone and p9cmeventhandler, while rdmarequest accesses the same field under the reqlock spinlock. This...

CVE-2026-72491

CVE-2026-72491 — Linux kernel net/9p rdma state race fixed. The rdma->state field was updated without req_lock in recv_done() and p9_cm_event_handler(), while rdma_request() reads/modifies under req_lock, risking lost transitions and potential use‑after‑free during teardown. The fix adds req_l...

CVE-2026-72166

CVE-2026-72166 affects the Linux kernel’s 9p client RPC path. In p9_client_rpc() when handling P9_TFLUSH, a fatal signal could cause an infinite loop if the transport has no peer, due to clearing TIF_SIGPENDING before rechecking signal_pending_state. The fix adds a check for fatal_signal_pending(...

PT-2025-18485 · Linux +1 · Linux Kernel +1

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A double-lock issue was reported by syzbot in the Linux kernel's 9p protocol, specifically in the trans fd/p9 conn cancel function. The lock is no longer needed after requests have bee...

Security update for the Linux Kernel (Live Patch 26 for SLE 15 SP4)

This update for the Linux Kernel 5.14.21-15040024119 fixes several issues. The following security issues were fixed: CVE-2024-36904: tcp: Use refcountincnotzero in tcptwskunique bsc1225733. CVE-2024-43861: Fix memory leak for not ip packets bsc1229553. CVE-2024-35905: Fixed int overflow for stack...

openSUSE: Security Advisory for qemu (SUSE-SU-2024:2977-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE SLES15: qemu / qemu-SLOF / qemu-arm / qemu-audio-alsa / qemu-audio-pa / etc (SUSE-SU-2024:2977-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:2977-1 advisory. - CVE-2023-2861: Fixed improper access control on special files via 9p protocol bsc1212968 - CVE-2024-4467: Fixed denial of service...

SUSE-SU-2024:2977-1 Security update for qemu

This update for qemu fixes the following issues: - CVE-2023-2861: Fixed improper access control on special files via 9p protocol bsc1212968 - CVE-2024-4467: Fixed denial of service and file read/write via qemu-img info command bsc1227322 Other fixes: - Fixed qemu build compilation with binutils...

CVE-2024-39463

In the Linux kernel, the following vulnerability has been resolved: 9p: add missing locking around taking dentry fid list Fix a use-after-free on dentry's dfsdata fid list when a thread looks up a fid through dentry while another thread unlinks it: UAF thread: refcountt: addition on 0;...

PT-2023-33326 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions 2.6.33 through 5.10.157 Description: A potential socket leak was identified in the p9 socket open function of the net/9p protocol. The issue was introduced in version v2.6.33 and fixed in version v5.10.158. The actual...

PT-2022-35942 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.10 Description: The issue is related to the trans fd/p9 conn cancel function in the 9p protocol, where the client lock is dropped earlier than expected. This is an automated ID intended to aid in discovery ...

PT-2022-36585 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v4.9.334 Description: The issue is related to the trans fd/p9 conn cancel function in the 9p protocol implementation, where the client lock is dropped earlier than expected. This is an automated ID intended to a...

PT-2022-36128 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.80 Description: The issue is related to the trans fd/p9 conn cancel function in the 9p protocol implementation, where the client lock is dropped earlier than expected. The actual impact and attack...

PT-2022-36464 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v4.19.267 Description: The issue is related to the trans fd/p9 conn cancel function in the 9p protocol implementation, where the client lock is dropped earlier than expected. The actual impact and attack...

PT-2025-18484

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A vulnerability has been resolved in the Linux kernel. The issue is related to the 9p protocol and file descriptor handling. Specifically, when the file descriptor refers to a pipe, the ...

PT-2025-26040

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A refcount leak issue in the Linux kernel's 9p protocol has been resolved. The problem occurred in the p9 read work error handling, where p9 req put needs to be called when m-rreq-rc.sda...