CVE-2026-72306: vduse: Fix race in vduse_dev_msg_sync and vduse_dev_read_iter
In the Linux kernel, the following vulnerability has been resolved:
vduse: Fix race in vdusedevmsgsync and vdusedevreaditer
There is one race case in vdusedevmsgsync and vdusedevreaditer:
vdusedevreaditer(): lock(msglock); dequeuemsg(sendlist); unlock(msglock); vdusedevmsgsync(): waittimeout() finish lock(msglock); check msg->complete is false listdel(msg); <- double listdel() crash!
To fix this case, we shall ensure vdusemsg is on sendlist or recvlist outside the msglock critical section.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72306?
CVE-2026-72306 has a risk rating of 38, indicating a significant potential impact.
How do I fix CVE-2026-72306?
To fix CVE-2026-72306, update your Linux kernel to the patched version that resolves this race condition.
What type of vulnerability is CVE-2026-72306?
CVE-2026-72306 is a race condition vulnerability in the Linux kernel related to vduse device messaging.
Which software is affected by CVE-2026-72306?
CVE-2026-72306 affects the Linux kernel maintained by The Linux Kernel Organization.
When was CVE-2026-72306 published?
CVE-2026-72306 was published on August 15, 2026.