In the Linux kernel, the following vulnerability has been resolved: 9p: avoid putting oldfid in p9_client_walk() error path When p9_client_walk() is called with clone set to false, fid aliases oldfid. If the walk subsequently fails after the request has been sent, the error path jumps to clunk_fid, which currently calls p9_fid_put(fid) unconditionally. This drops a reference to oldfid even though ownership of oldfid remains with the caller. If this is the last reference, oldfid can be clunked and destroyed while the caller still expects it to be valid. A later use or put of oldfid can then trigger a use-after-free or refcount underflow. Fix this by only putting fid in the clunk_fid error path when it does not alias oldfid, matching the existing guard in the error path below. This can be triggered when a multi-component walk is split into multiple p9_client_walk() calls and a later non-cloning walk fails. A reproducer and refcount warning logs are available on request.
Casky was already ahead
This CVE exploits attack patterns that Casky's 0matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.
CVE-2026-63795 is a critical reference counting vulnerability in the Linux kernel's 9p (Plan 9) filesystem protocol implementation. When p9_client_walk() encounters an error after sending a walk request with cloning disabled, the error handler incorrectly decrements the reference count on the original file identifier (oldfid), even though ownership remains with the caller. This premature reference drop can lead to use-after-free conditions, memory corruption, or denial of service when the oldfid is subsequently accessed or freed. The vulnerability affects any Linux system using the 9p protocol for filesystem operations, including containerized environments and systems using Plan 9 file servers, making this a critical issue for infrastructure operators managing distributed or virtualized deployments.
Casky.ai's extended reasoning capabilities would identify this vulnerability as relating to improper resource lifecycle management and error handling patterns, even without explicit MITRE ATT&CK mappings. Practitioners using Casky would detect the attack surface through analysis of kernel resource management flows, particularly around file descriptor handling and reference counting validation. The platform would flag anomalous error paths in protocol handlers where resource ownership semantics are violated—specifically cases where cleanup routines release resources not owned by the current code path. Security teams would see findings highlighting the need for strict resource ownership tracking during error conditions and the importance of auditing all error branches in filesystem protocol implementations for reference counting correctness.
Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →
Casky has 0 skills that investigate the attack patterns behind CVE-2026-63795. Run one and get CVSS-scored findings in 3 minutes.
Run the skill that detects this →© 2026 Casky.AI, Inc. · AI Security Investigation