---
id: CVE-2026-72305
title: 'VDUSE: avoid leaking information to userspace'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  VDUSE: avoid leaking information to userspace

  The bounceing is not necessarily page aligned, so current VDUSE can
  leak kernel information through mapping bounce pages …
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 8c773d53fb7b64267b0f55c1d3517cb8c5e29b3c <
    41e27a6aca608c9e04f091c29c420d03fafe0313
  - >-
    Linux >= 8c773d53fb7b64267b0f55c1d3517cb8c5e29b3c <
    3ae878f262bd1445c8c31511856a99962a05fe16
  - >-
    Linux >= 8c773d53fb7b64267b0f55c1d3517cb8c5e29b3c <
    fde25641cbddd0c084e3320d08f755e7e6acfae5
  - >-
    Linux >= 8c773d53fb7b64267b0f55c1d3517cb8c5e29b3c <
    5e88c1bc3a41d9a260dd42bae8ad18fd4f35bbe1
  - >-
    Linux >= 8c773d53fb7b64267b0f55c1d3517cb8c5e29b3c <
    690fb82c4122f8c2656fa4f842275132771b68b9
  - >-
    Linux >= 8c773d53fb7b64267b0f55c1d3517cb8c5e29b3c <
    00335df9da2011e095f846d645cc2e9fd2907659
  - >-
    Linux >= 8c773d53fb7b64267b0f55c1d3517cb8c5e29b3c <
    9c1523803445ee0348f62b77793266dd981596e0
  - Linux 5.15
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T16:54:23.648097Z'
published: '2026-08-15'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T16:55:25.511Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-72305'
references:
  - url: 'https://git.kernel.org/stable/c/41e27a6aca608c9e04f091c29c420d03fafe0313'
  - url: 'https://git.kernel.org/stable/c/3ae878f262bd1445c8c31511856a99962a05fe16'
  - url: 'https://git.kernel.org/stable/c/fde25641cbddd0c084e3320d08f755e7e6acfae5'
  - url: 'https://git.kernel.org/stable/c/5e88c1bc3a41d9a260dd42bae8ad18fd4f35bbe1'
  - url: 'https://git.kernel.org/stable/c/690fb82c4122f8c2656fa4f842275132771b68b9'
  - url: 'https://git.kernel.org/stable/c/00335df9da2011e095f846d645cc2e9fd2907659'
  - url: 'https://git.kernel.org/stable/c/9c1523803445ee0348f62b77793266dd981596e0'
tags:
  - cve.org
epss: 0.00211
epssPercentile: 0.11448
ingestedAt: '2026-11-06T18:00:12.580Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

VDUSE: avoid leaking information to userspace

The bounceing is not necessarily page aligned, so current VDUSE can
leak kernel information through mapping bounce pages to
userspace. Allocate bounce pages with __GFP_ZERO to avoid leaking
information to userspace.

## Affected

- `Linux >= 8c773d53fb7b64267b0f55c1d3517cb8c5e29b3c < 41e27a6aca608c9e04f091c29c420d03fafe0313`
- `Linux >= 8c773d53fb7b64267b0f55c1d3517cb8c5e29b3c < 3ae878f262bd1445c8c31511856a99962a05fe16`
- `Linux >= 8c773d53fb7b64267b0f55c1d3517cb8c5e29b3c < fde25641cbddd0c084e3320d08f755e7e6acfae5`
- `Linux >= 8c773d53fb7b64267b0f55c1d3517cb8c5e29b3c < 5e88c1bc3a41d9a260dd42bae8ad18fd4f35bbe1`
- `Linux >= 8c773d53fb7b64267b0f55c1d3517cb8c5e29b3c < 690fb82c4122f8c2656fa4f842275132771b68b9`
- `Linux >= 8c773d53fb7b64267b0f55c1d3517cb8c5e29b3c < 00335df9da2011e095f846d645cc2e9fd2907659`
- `Linux >= 8c773d53fb7b64267b0f55c1d3517cb8c5e29b3c < 9c1523803445ee0348f62b77793266dd981596e0`
- `Linux 5.15`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.