CVE-2026-72138
Received Received - Intake

Memory Leak in Linux Kernel Xen Gntdev

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: xen/gntdev: fix error handling in ioctl When gntdev_ioctl_map_grant_ref() fails to copy the operation result back to userspace after successfully adding the mapping to the list, the error path returns -EFAULT without releasing the reference acquired by gntdev_alloc_map(). The mapping remains in priv->maps with a refcount of 1, causing a memory leak and a dangling list entry. Additionally, gntdev_add_map() may modify map->index to avoid overlap with existing mappings. Therefore, the index returned to userspace must be obtained after gntdev_add_map() completes. Fix this by holding the mutex across gntdev_add_map(), retrieving the correct index, and copy_to_user(). If copy_to_user() fails, remove the mapping from the list and release the reference while still holding the lock. Fix these issues by properly handling all error cases.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-15
Last Modified
2026-08-15
Generated
2026-08-15
AI Q&A
2026-08-15
EPSS Evaluated
N/A
NVD
CVE-2026-72138
EUVD
EUVD-2026-58896

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the Linux kernel's xen/gntdev component. It involves improper error handling in an ioctl operation where a memory leak occurs if a specific function fails to copy data back to userspace. The issue arises when a reference is acquired but not released, leaving a dangling list entry and causing a memory leak.

Detection Guidance

This vulnerability is specific to the Linux kernel's xen/gntdev driver and requires kernel-level inspection. Detection involves checking kernel logs for errors related to gntdev_ioctl_map_grant_ref or memory leaks in the xen/gntdev subsystem. Use commands like dmesg | grep gntdev or journalctl -k | grep gntdev to search for relevant errors. Ensure your kernel version is updated to a patched release.

Impact Analysis

This vulnerability could lead to memory leaks in the Linux kernel, potentially causing system instability or resource exhaustion over time. It may affect systems using the xen/gntdev driver, particularly those with frequent ioctl operations.

Mitigation Strategies

Immediately update your Linux kernel to the latest stable version that includes the fix for this CVE. If updating is not immediately possible, disable the xen/gntdev driver if not in use by blacklisting the module or restricting access to the device file /dev/xen/gntdev. Monitor system logs for signs of exploitation or memory leaks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72138. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart