CVE-2026-97983 (GCVE-0-2026-97983)
Vulnerability from cvelistv5
Published
2026-09-25 10:23
Modified
2026-10-19 09:11
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: vduse: return compat ioctl results directly The compat handler handles VDUSE_IOTLB_GET_FD and VDUSE_VQ_GET_INFO, but then calls the native handler. Their different command sizes make native dispatch return -ENOIOCTLCMD. For GET_FD, this overwrites receive_fd()'s return value after the descriptor is installed, leaking one fd per call. Return handled compat results directly and use native dispatch only for other commands.
References
Impacted products
Vendor Product Version
Linux Linux Version: 455a2a1af92651764e9eb42cec0d95ac142afc28
Version: 455a2a1af92651764e9eb42cec0d95ac142afc28
Version: 7dd28904c42ee3b0728c0692dd3332c2c83e8f33
Version: 7.1.5   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/vdpa/vdpa_user/vduse_dev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "135ac58097fa5fc707bf392c5cececf59e4080c0",
              "status": "affected",
              "version": "455a2a1af92651764e9eb42cec0d95ac142afc28",
              "versionType": "git"
            },
            {
              "lessThan": "48a4ee65e677559776349128e6a81a6041986c99",
              "status": "affected",
              "version": "455a2a1af92651764e9eb42cec0d95ac142afc28",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "7dd28904c42ee3b0728c0692dd3332c2c83e8f33",
              "versionType": "git"
            },
            {
              "lessThan": "7.2",
              "status": "affected",
              "version": "7.1.5",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/vdpa/vdpa_user/vduse_dev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.2"
            },
            {
              "lessThan": "7.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.7",
                  "versionStartIncluding": "7.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "7.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "7.1.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvduse: return compat ioctl results directly\n\nThe compat handler handles VDUSE_IOTLB_GET_FD and VDUSE_VQ_GET_INFO, but\nthen calls the native handler. Their different command sizes make native\ndispatch return -ENOIOCTLCMD.\n\nFor GET_FD, this overwrites receive_fd()\u0027s return value after the\ndescriptor is installed, leaking one fd per call. Return handled compat\nresults directly and use native dispatch only for other commands."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T09:11:50.328Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/135ac58097fa5fc707bf392c5cececf59e4080c0"
        },
        {
          "url": "https://git.kernel.org/stable/c/48a4ee65e677559776349128e6a81a6041986c99"
        }
      ],
      "title": "vduse: return compat ioctl results directly",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-97983",
    "datePublished": "2026-09-25T10:23:18.940Z",
    "dateReserved": "2026-09-25T10:18:58.208Z",
    "dateUpdated": "2026-10-19T09:11:50.328Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.