CVE-2026-72482

Received Received - Intake

Use-After-Free in Linux Kernel GPIB Subsystem

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: gpib: fix double decrement of descriptor_busy in command_ioctl() commit d1857f8296dc ("gpib: fix use-after-free in IO ioctl handlers") introduced a descriptor_busy reference counter to pin struct gpib_descriptor across IO ioctl operations. In command_ioctl(), the error path inside the loop decrements descriptor_busy and breaks, but execution then falls through to the unconditional decrement after the loop, underflowing the counter to -1. This re-enables the use-after-free that the original fix was meant to prevent: a concurrent close_dev_ioctl() sees descriptor_busy == 0 on an actively-used descriptor and frees it. Remove the early decrement from the error path. The post-loop decrement already handles all exit paths, matching the correct pattern used in read_ioctl() and write_ioctl().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72482

EUVD

EUVD-2026-59381

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a double decrement of a reference counter called descriptor_busy in the command_ioctl() function. The error path inside a loop incorrectly decrements the counter and then falls through to another decrement after the loop, causing the counter to underflow to -1. This re-enables a use-after-free issue where a concurrent operation could free an actively-used descriptor.

Detection Guidance

This vulnerability is specific to the Linux kernel's GPIB subsystem and does not have network-based detection methods. It requires kernel-level inspection. Check kernel logs for gpib-related errors or crashes using: dmesg | grep gpib. If the system uses GPIB devices, monitor for descriptor-related issues during ioctl operations.

Impact Analysis

This vulnerability could allow an attacker to trigger a use-after-free condition, potentially leading to system crashes, privilege escalation, or arbitrary code execution. Systems using affected Linux kernel versions with GPIB (General Purpose Interface Bus) functionality may be at risk.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it pertains to a Linux kernel driver for GPIB devices. The issue involves a use-after-free bug in the gpib subsystem, which could lead to memory corruption or crashes but does not inherently involve data privacy or security controls required by these regulations.

Mitigation Strategies

Update the Linux kernel to a patched version that includes the fix for CVE-2026-72482. If immediate patching is not possible, disable the GPIB subsystem if not in use by blacklisting the gpib kernel module: echo 'blacklist gpib' >> /etc/modprobe.d/disable-gpib.conf.

Hi! I’m here to help you understand CVE-2026-72482. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70