CVE-2026-72306

vduse: Fix race in vduse_dev_msg_sync and vduse_dev_read_iter

State: Published
Severity: Not scored
Published: Aug 15, 2026
Updated: Aug 17, 2026
Reserved: Aug 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

vduse: Fix race in vduse_dev_msg_sync and vduse_dev_read_iter

There is one race case in vduse_dev_msg_sync and vduse_dev_read_iter:

vduse_dev_read_iter(): lock(msg_lock); dequeue_msg(send_list); unlock(msg_lock); vduse_dev_msg_sync(): wait_timeout() finish lock(msg_lock); check msg->complete is false list_del(msg); <- double list_del() crash!

To fix this case, we shall ensure vduse_msg is on send_list or recv_list outside the msg_lock critical section.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	c8a6153b6c59d95c0e091f053f6f180952ade91e to before c83ad3dfa6d9953d5ce6839416bf5a1bfc50285aAffected c8a6153b6c59d95c0e091f053f6f180952ade91e to before 09723f26ed801c083e914cec4cc0e1af4b933dc7Affected c8a6153b6c59d95c0e091f053f6f180952ade91e to before d7e7c813834c6c05c26033456ab7169e2f9c99ebAffected c8a6153b6c59d95c0e091f053f6f180952ade91e to before 3755965adbb617f4283ac6ccd351ed0676843cbaAffected c8a6153b6c59d95c0e091f053f6f180952ade91e to before d8715b5a8fdb23fef576700e71d0c253dbeddad4Affected c8a6153b6c59d95c0e091f053f6f180952ade91e to before 8062ff9d366c4bc4ae775e14eac9a769f20c60ddAffected c8a6153b6c59d95c0e091f053f6f180952ade91e to before ae9c13b6fd79087cc5a216ee1649b6f012c2a238Affected
LinuxLinux	5.15Affected before 5.15Not affected 5.15.212 through 5.15.Not affected 6.1.178 through 6.1.Not affected 6.6.145 through 6.6.Not affected 6.12.97 through 6.12.Not affected 6.18.40 through 6.18.Not affected 7.1.5 through 7.1.Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

c8a6153b6c59d95c0e091f053f6f180952ade91e to before c83ad3dfa6d9953d5ce6839416bf5a1bfc50285aAffected
c8a6153b6c59d95c0e091f053f6f180952ade91e to before 09723f26ed801c083e914cec4cc0e1af4b933dc7Affected
c8a6153b6c59d95c0e091f053f6f180952ade91e to before d7e7c813834c6c05c26033456ab7169e2f9c99ebAffected
c8a6153b6c59d95c0e091f053f6f180952ade91e to before 3755965adbb617f4283ac6ccd351ed0676843cbaAffected
c8a6153b6c59d95c0e091f053f6f180952ade91e to before d8715b5a8fdb23fef576700e71d0c253dbeddad4Affected
c8a6153b6c59d95c0e091f053f6f180952ade91e to before 8062ff9d366c4bc4ae775e14eac9a769f20c60ddAffected
c8a6153b6c59d95c0e091f053f6f180952ade91e to before ae9c13b6fd79087cc5a216ee1649b6f012c2a238Affected

LinuxLinux

5.15Affected
before 5.15Not affected
5.15.212 through 5.15.*Not affected
6.1.178 through 6.1.*Not affected
6.6.145 through 6.6.*Not affected
6.12.97 through 6.12.*Not affected
6.18.40 through 6.18.*Not affected
7.1.5 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.