CVE-2026-72306

Received Received - Intake

Race Condition in Linux Kernel VDUSE Driver

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: vduse: Fix race in vduse_dev_msg_sync and vduse_dev_read_iter There is one race case in vduse_dev_msg_sync and vduse_dev_read_iter: vduse_dev_read_iter(): lock(msg_lock); dequeue_msg(send_list); unlock(msg_lock); vduse_dev_msg_sync(): wait_timeout() finish lock(msg_lock); check msg->complete is false list_del(msg); <- double list_del() crash! To fix this case, we shall ensure vduse_msg is on send_list or recv_list outside the msg_lock critical section.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72306

EUVD

EUVD-2026-59205

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a race condition vulnerability in the Linux kernel's vduse driver. It occurs when two functions, vduse_dev_msg_sync and vduse_dev_read_iter, access shared message lists without proper synchronization. The issue leads to a double list deletion operation, causing a system crash.

Detection Guidance

This vulnerability is specific to the Linux kernel's vduse driver and may not have direct network detection methods. Check kernel logs for crashes or errors related to vduse with commands like 'dmesg | grep vduse' or 'journalctl -k | grep vduse'.

Impact Analysis

If exploited, this vulnerability could crash the affected system, leading to denial of service. Systems using the vduse driver with virtualization features may become unstable or unresponsive.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a low-level kernel race condition in the vduse subsystem. Compliance impacts would only occur if this vulnerability led to data corruption or unauthorized access, which is not specified in the provided context.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for CVE-2026-72306. If immediate patching is not possible, consider disabling the vduse module with 'modprobe -r vduse' if not in use.

Hi! I’m here to help you understand CVE-2026-72306. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70