{"id":"CVE-2026-72138","title":"xen/gntdev: fix error handling in ioctl","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nxen/gntdev: fix error handling in ioctl\n\nWhen gntdev_ioctl_map_grant_ref() fails to copy the operation result\nback to userspace after successfully adding the mapping to…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 68b025c813c2eb41ff25628e3d4952d5185eb1a4 < 52dc40ef0cfee6ae89b7524967e73f0ba37906d7","Linux >= 68b025c813c2eb41ff25628e3d4952d5185eb1a4 < 1dd9cb98fe228e017fff9efb33862ff38c741b65","Linux >= 68b025c813c2eb41ff25628e3d4952d5185eb1a4 < 6df926130aee6cab9b5d2e5b7862e49ccac348dc","Linux >= 68b025c813c2eb41ff25628e3d4952d5185eb1a4 < 311011f8cc206c5af2877b03e3f627ee1b8fe024","Linux >= 68b025c813c2eb41ff25628e3d4952d5185eb1a4 < 18a693733f7ad004e1ab0466693121ca70cd95dd","Linux >= 68b025c813c2eb41ff25628e3d4952d5185eb1a4 < 16d3ccdabb8dee9be2cdcd6d3f9a125572ec0454","Linux >= 68b025c813c2eb41ff25628e3d4952d5185eb1a4 < 6883269a323609f68f6faa903f8f8ff3d191cec8","Linux >= 68b025c813c2eb41ff25628e3d4952d5185eb1a4 < 45ca1afe2fd14c04e37227e79d3f8455831d8408","Linux 2.6.39"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-06T16:51:54.267529Z"},"published":"2026-08-15","updated":"2026-11-06","sourceUpdated":"2026-11-06T16:55:20.776Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-72138","references":[{"url":"https://git.kernel.org/stable/c/52dc40ef0cfee6ae89b7524967e73f0ba37906d7"},{"url":"https://git.kernel.org/stable/c/1dd9cb98fe228e017fff9efb33862ff38c741b65"},{"url":"https://git.kernel.org/stable/c/6df926130aee6cab9b5d2e5b7862e49ccac348dc"},{"url":"https://git.kernel.org/stable/c/311011f8cc206c5af2877b03e3f627ee1b8fe024"},{"url":"https://git.kernel.org/stable/c/18a693733f7ad004e1ab0466693121ca70cd95dd"},{"url":"https://git.kernel.org/stable/c/16d3ccdabb8dee9be2cdcd6d3f9a125572ec0454"},{"url":"https://git.kernel.org/stable/c/6883269a323609f68f6faa903f8f8ff3d191cec8"},{"url":"https://git.kernel.org/stable/c/45ca1afe2fd14c04e37227e79d3f8455831d8408"}],"tags":["cve.org"],"epss":0.00216,"epssPercentile":0.12144,"ingestedAt":"2026-11-06T18:00:12.593Z","slug":"CVE-2026-72138","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nxen/gntdev: fix error handling in ioctl\n\nWhen gntdev_ioctl_map_grant_ref() fails to copy the operation result\nback to userspace after successfully adding the mapping to the list,\nthe error path returns -EFAULT without releasing the reference\nacquired by gntdev_alloc_map(). The mapping remains in priv->maps\nwith a refcount of 1, causing a memory leak and a dangling list\nentry.\n\nAdditionally, gntdev_add_map() may modify map->index to avoid overlap\nwith existing mappings. Therefore, the index returned to userspace\nmust be obtained after gntdev_add_map() completes.\n\nFix this by holding the mutex across gntdev_add_map(), retrieving\nthe correct index, and copy_to_user(). If copy_to_user() fails,\nremove the mapping from the list and release the reference while\nstill holding the lock.\n\n\nFix these issues by properly handling all error cases.\n\n## Affected\n\n- `Linux >= 68b025c813c2eb41ff25628e3d4952d5185eb1a4 < 52dc40ef0cfee6ae89b7524967e73f0ba37906d7`\n- `Linux >= 68b025c813c2eb41ff25628e3d4952d5185eb1a4 < 1dd9cb98fe228e017fff9efb33862ff38c741b65`\n- `Linux >= 68b025c813c2eb41ff25628e3d4952d5185eb1a4 < 6df926130aee6cab9b5d2e5b7862e49ccac348dc`\n- `Linux >= 68b025c813c2eb41ff25628e3d4952d5185eb1a4 < 311011f8cc206c5af2877b03e3f627ee1b8fe024`\n- `Linux >= 68b025c813c2eb41ff25628e3d4952d5185eb1a4 < 18a693733f7ad004e1ab0466693121ca70cd95dd`\n- `Linux >= 68b025c813c2eb41ff25628e3d4952d5185eb1a4 < 16d3ccdabb8dee9be2cdcd6d3f9a125572ec0454`\n- `Linux >= 68b025c813c2eb41ff25628e3d4952d5185eb1a4 < 6883269a323609f68f6faa903f8f8ff3d191cec8`\n- `Linux >= 68b025c813c2eb41ff25628e3d4952d5185eb1a4 < 45ca1afe2fd14c04e37227e79d3f8455831d8408`\n- `Linux 2.6.39`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}