CVE-2026-74313

vduse: hold vduse_lock across IDR lookup in open path

State: Published
Severity: 8.8 High
Published: Aug 15, 2026
Updated: Oct 16, 2026
Reserved: Aug 15, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

vduse: hold vduse_lock across IDR lookup in open path

vduse_dev_open() looks up struct vduse_dev through the IDR and then acquires dev->lock only after vduse_lock has been dropped.

This leaves a window where a concurrent VDUSE_DESTROY_DEV can remove the same object from the IDR and free it before the open path locks the device, leading to a use-after-free.

Close this race by keeping vduse_lock held until dev->lock has been acquired in the open path, matching the lock ordering already used by the destroy path.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	c8a6153b6c59d95c0e091f053f6f180952ade91e to before 35483c5306e09b3190ff937089d404a78012695cAffected c8a6153b6c59d95c0e091f053f6f180952ade91e to before 5c1560be8aa6849356455af67518d35c551cbd95Affected c8a6153b6c59d95c0e091f053f6f180952ade91e to before 93ed4692f2299a40346025979f40e4a9b7b33af7Affected c8a6153b6c59d95c0e091f053f6f180952ade91e to before d94e2947203aead590fd63f667d316d4475d65afAffected c8a6153b6c59d95c0e091f053f6f180952ade91e to before a2d0a57538fd0b3b3ab75d64bb64f4cd2fab13a2Affected c8a6153b6c59d95c0e091f053f6f180952ade91e to before 79e12c891940b0c4c75881b7fd82a8cbb8ac97beAffected c8a6153b6c59d95c0e091f053f6f180952ade91e to before e440e077748939839d9f76e24383b76b785f80ceAffected
LinuxLinux	5.15Affected before 5.15Not affected 5.15.212 through 5.15.Not affected 6.1.178 through 6.1.Not affected 6.6.145 through 6.6.Not affected 6.12.97 through 6.12.Not affected 6.18.40 through 6.18.Not affected 7.1.5 through 7.1.Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

c8a6153b6c59d95c0e091f053f6f180952ade91e to before 35483c5306e09b3190ff937089d404a78012695cAffected
c8a6153b6c59d95c0e091f053f6f180952ade91e to before 5c1560be8aa6849356455af67518d35c551cbd95Affected
c8a6153b6c59d95c0e091f053f6f180952ade91e to before 93ed4692f2299a40346025979f40e4a9b7b33af7Affected
c8a6153b6c59d95c0e091f053f6f180952ade91e to before d94e2947203aead590fd63f667d316d4475d65afAffected
c8a6153b6c59d95c0e091f053f6f180952ade91e to before a2d0a57538fd0b3b3ab75d64bb64f4cd2fab13a2Affected
c8a6153b6c59d95c0e091f053f6f180952ade91e to before 79e12c891940b0c4c75881b7fd82a8cbb8ac97beAffected
c8a6153b6c59d95c0e091f053f6f180952ade91e to before e440e077748939839d9f76e24383b76b785f80ceAffected

LinuxLinux

5.15Affected
before 5.15Not affected
5.15.212 through 5.15.*Not affected
6.1.178 through 6.1.*Not affected
6.6.145 through 6.6.*Not affected
6.12.97 through 6.12.*Not affected
6.18.40 through 6.18.*Not affected
7.1.5 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.