CVE-2026-97983
vduse: return compat ioctl results directly
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 7.2, 7.2.7
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
In the Linux kernel, the following vulnerability has been resolved: vduse: return compat ioctl results directly The compat handler handles VDUSE_IOTLB_GET_FD and VDUSE_VQ_GET_INFO, but then calls the native handler. Their different command sizes make native dispatch return -ENOIOCTLCMD. For GET_FD, this overwrites receive_fd()'s return value after the descriptor is installed, leaking one fd per call. Return handled compat results directly and use native dispatch only for other commands.
Timeline
- CVE published
- Record last updated
Affected versions
- Linux Linux
From 455a2a1af92651764e9eb42cec0d95ac142afc28 · fixed in 135ac58097fa5fc707bf392c5cececf59e4080c0; From 455a2a1af92651764e9eb42cec0d95ac142afc28 · fixed in 48a4ee65e677559776349128e6a81a6041986c99; From 7.1.5 · fixed in 7.2
- Linux Linux
7.2
- KernelLinux
From 7.2.0 · fixed in 7.2.7