{"id":"CVE-2026-72305","title":"VDUSE: avoid leaking information to userspace","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nVDUSE: avoid leaking information to userspace\n\nThe bounceing is not necessarily page aligned, so current VDUSE can\nleak kernel information through mapping bounce pages …","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 8c773d53fb7b64267b0f55c1d3517cb8c5e29b3c < 41e27a6aca608c9e04f091c29c420d03fafe0313","Linux >= 8c773d53fb7b64267b0f55c1d3517cb8c5e29b3c < 3ae878f262bd1445c8c31511856a99962a05fe16","Linux >= 8c773d53fb7b64267b0f55c1d3517cb8c5e29b3c < fde25641cbddd0c084e3320d08f755e7e6acfae5","Linux >= 8c773d53fb7b64267b0f55c1d3517cb8c5e29b3c < 5e88c1bc3a41d9a260dd42bae8ad18fd4f35bbe1","Linux >= 8c773d53fb7b64267b0f55c1d3517cb8c5e29b3c < 690fb82c4122f8c2656fa4f842275132771b68b9","Linux >= 8c773d53fb7b64267b0f55c1d3517cb8c5e29b3c < 00335df9da2011e095f846d645cc2e9fd2907659","Linux >= 8c773d53fb7b64267b0f55c1d3517cb8c5e29b3c < 9c1523803445ee0348f62b77793266dd981596e0","Linux 5.15"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-06T16:54:23.648097Z"},"published":"2026-08-15","updated":"2026-11-06","sourceUpdated":"2026-11-06T16:55:25.511Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-72305","references":[{"url":"https://git.kernel.org/stable/c/41e27a6aca608c9e04f091c29c420d03fafe0313"},{"url":"https://git.kernel.org/stable/c/3ae878f262bd1445c8c31511856a99962a05fe16"},{"url":"https://git.kernel.org/stable/c/fde25641cbddd0c084e3320d08f755e7e6acfae5"},{"url":"https://git.kernel.org/stable/c/5e88c1bc3a41d9a260dd42bae8ad18fd4f35bbe1"},{"url":"https://git.kernel.org/stable/c/690fb82c4122f8c2656fa4f842275132771b68b9"},{"url":"https://git.kernel.org/stable/c/00335df9da2011e095f846d645cc2e9fd2907659"},{"url":"https://git.kernel.org/stable/c/9c1523803445ee0348f62b77793266dd981596e0"}],"tags":["cve.org"],"epss":0.00211,"epssPercentile":0.11448,"ingestedAt":"2026-11-06T18:00:12.580Z","slug":"CVE-2026-72305","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nVDUSE: avoid leaking information to userspace\n\nThe bounceing is not necessarily page aligned, so current VDUSE can\nleak kernel information through mapping bounce pages to\nuserspace. Allocate bounce pages with __GFP_ZERO to avoid leaking\ninformation to userspace.\n\n## Affected\n\n- `Linux >= 8c773d53fb7b64267b0f55c1d3517cb8c5e29b3c < 41e27a6aca608c9e04f091c29c420d03fafe0313`\n- `Linux >= 8c773d53fb7b64267b0f55c1d3517cb8c5e29b3c < 3ae878f262bd1445c8c31511856a99962a05fe16`\n- `Linux >= 8c773d53fb7b64267b0f55c1d3517cb8c5e29b3c < fde25641cbddd0c084e3320d08f755e7e6acfae5`\n- `Linux >= 8c773d53fb7b64267b0f55c1d3517cb8c5e29b3c < 5e88c1bc3a41d9a260dd42bae8ad18fd4f35bbe1`\n- `Linux >= 8c773d53fb7b64267b0f55c1d3517cb8c5e29b3c < 690fb82c4122f8c2656fa4f842275132771b68b9`\n- `Linux >= 8c773d53fb7b64267b0f55c1d3517cb8c5e29b3c < 00335df9da2011e095f846d645cc2e9fd2907659`\n- `Linux >= 8c773d53fb7b64267b0f55c1d3517cb8c5e29b3c < 9c1523803445ee0348f62b77793266dd981596e0`\n- `Linux 5.15`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}