From d55cf9a9d0f518331e01d78fff88e2f06d0f9ef9 Mon Sep 17 00:00:00 2001
From: SolitudePy <47316655+SolitudePy@users.noreply.github.com>
Date: Wed, 25 Jun 2025 19:07:17 +0300
Subject: [PATCH] Plugins: remove exe_file dereference()

---
 .../framework/plugins/linux/malware/process_spoofing.py       | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/volatility3/framework/plugins/linux/malware/process_spoofing.py b/volatility3/framework/plugins/linux/malware/process_spoofing.py
index b14dd208c..f32f80f8a 100644
--- a/volatility3/framework/plugins/linux/malware/process_spoofing.py
+++ b/volatility3/framework/plugins/linux/malware/process_spoofing.py
@@ -61,7 +61,7 @@ class ProcessSpoofing(plugins.PluginInterface):
         try:
             mm = task.mm
             if not mm or not mm.is_readable():
-                # Kernel threads doesn't have mm
+                # Kernel threads don't have mm struct
                 return None
 
             exe_file = mm.exe_file
@@ -69,7 +69,7 @@ class ProcessSpoofing(plugins.PluginInterface):
             if not exe_file or not exe_file.is_readable():
                 return None
 
-            exe_inode = exe_file.dereference().f_path.dentry.d_inode
+            exe_inode = exe_file.f_path.dentry.d_inode
             exe_path = linux.LinuxUtilities.path_for_file(self.context, task, exe_file)
 
             # If the inode link count is 0, the process image has been deleted