CVE-2026-72306
In the Linux kernel, the following vulnerability has been resolved: vduse: Fix race in vduse_dev_msg_sync and vduse_dev_read_iter There is one race case in vduse_dev_msg_sync and vduse_dev_read_iter: vduse_dev_read_iter(): lock(msg_lock); dequeue_msg(send_list); unlock(msg_lock); vduse_dev_msg_sync(): wait_timeout() finish lock(msg_lock); check msg->complete is false list_del(msg); <- double list_del() crash! To fix this case, we shall ensure vduse_msg is on send_list or recv_list outside the msg_lock critical section.
Affected versions
Linux kernel versions
5.15
and later are affected. Fixed in
5.15.212,
6.1.178,
6.6.145,
6.12.97,
6.18.40,
7.1.5,
7.2-rc1
and their respective stable series.
References
7 totalFrequently asked questions
-
What is CVE-2026-72306?
CVE-2026-72306 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 5.15 onward and has been patched in 5.15.212, 6.1.178, 6.6.145 and others. CVE-2026-72306 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-72306?
Yes. CVE-2026-72306 has been patched. Fixed versions include 5.15.212, 6.1.178, 6.6.145 and others. If you are running Linux kernel 5.15 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-72306 actively exploited?
No. CVE-2026-72306 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.