CVE-2026-97983: vduse: return compat ioctl results directly
In the Linux kernel, the following vulnerability has been resolved:
vduse: return compat ioctl results directly
The compat handler handles VDUSEIOTLBGETFD and VDUSEVQGETINFO, but then calls the native handler. Their different command sizes make native dispatch return -ENOIOCTLCMD.
For GETFD, this overwrites receivefd()'s return value after the descriptor is installed, leaking one fd per call. Return handled compat results directly and use native dispatch only for other commands.
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Systems using the Linux kernel VDUSE interface are exposed when a caller can invoke the affected compat ioctl path. The descriptor leak is tied specifically to VDUSE_IOTLB_GET_FD; VDUSE_VQ_GET_INFO is also handled by the faulty compat-to-native dispatch flow.
What does an attacker need to do to trigger the resource leak?
They need to repeatedly issue the compat VDUSE_IOTLB_GET_FD ioctl. Each call can install a file descriptor and then return -ENOIOCTLCMD because the native handler rejects the differently sized compat command, leaking one descriptor per call.
How can I tell whether a system is affected?
Check whether the running kernel contains either referenced stable fix commit, 135ac58097fa5fc707bf392c5cececf59e4080c0 or 48a4ee65e677559776349128e6a81a6041986c99. Affected behavior is indicated by compat VDUSE_IOTLB_GET_FD calls returning -ENOIOCTLCMD after a descriptor has been installed.