CVE-2026-72306None▾ SunlitIn the Linux kernel, the following vulnerability has been resolved: vduse: Fix race in vduse_dev_msg_sync and vduse_dev_read_iter There is one race case in vduse_dev_msg_sync and vduse_dev_read_iter: vduse_dev_read_iter(): lock(ms…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Nov 6.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.2%
In the Linux kernel, the following vulnerability has been resolved:
vduse: Fix race in vduse_dev_msg_sync and vduse_dev_read_iter
There is one race case in vduse_dev_msg_sync and vduse_dev_read_iter:
vduse_dev_read_iter(): lock(msg_lock); dequeue_msg(send_list); unlock(msg_lock); vduse_dev_msg_sync(): wait_timeout() finish lock(msg_lock); check msg->complete is false list_del(msg); <- double list_del() crash!
To fix this case, we shall ensure vduse_msg is on send_list or recv_list outside the msg_lock critical section.
Linux >= c8a6153b6c59d95c0e091f053f6f180952ade91e < c83ad3dfa6d9953d5ce6839416bf5a1bfc50285aLinux >= c8a6153b6c59d95c0e091f053f6f180952ade91e < 09723f26ed801c083e914cec4cc0e1af4b933dc7Linux >= c8a6153b6c59d95c0e091f053f6f180952ade91e < d7e7c813834c6c05c26033456ab7169e2f9c99ebLinux >= c8a6153b6c59d95c0e091f053f6f180952ade91e < 3755965adbb617f4283ac6ccd351ed0676843cbaLinux >= c8a6153b6c59d95c0e091f053f6f180952ade91e < d8715b5a8fdb23fef576700e71d0c253dbeddad4Linux >= c8a6153b6c59d95c0e091f053f6f180952ade91e < 8062ff9d366c4bc4ae775e14eac9a769f20c60ddLinux >= c8a6153b6c59d95c0e091f053f6f180952ade91e < ae9c13b6fd79087cc5a216ee1649b6f012c2a238Linux 5.15Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-99284Nonenet: skbuff: propagate shared-frag marker in skb_zerocopy()
CVE-2026-99283Nonenetfilter: conntrack: tcp: use UNACK timeout for non-closing RST packets
CVE-2026-99272Nonesmb: client: validate the data area in SMB2_read()
CVE-2026-99271NoneALSA: line6: Clear prev_fbuf on capture buffer release
CVE-2026-99273Noneksmbd: reserve space for the UTF-16 terminator in stream info
CVE-2026-99275Nonesmb: client: reject short SESSION_SETUP responses