Skip to main content

Linux Kernel CVE-2026-72282

| EUVDEUVD-2026-59181 HIGH
2026-08-15 Linux GHSA-4pjm-pq6c-p9x5
Information Disclosure Linux Red Hat Suse
7.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.0 HIGH

Race condition against SRCU lock release requires precise timing, warranting AC:H over the provided AC:L; PR:L reflects required /dev/kvm group membership.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
4.7 MEDIUM
AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 17, 2026 - 08:06 vuln.today
CVSS changed
Aug 17, 2026 - 06:22 NVD
7.8 (HIGH)
Patch available
Aug 15, 2026 - 07:20 EUVD
CVE Published
Aug 15, 2026 - 05:55 cve.org
HIGH 7.8
CVE Published
Aug 15, 2026 - 05:55 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers

kvm_io_bus_get_dev() returns a device that is only matched by the address, and nothing else. This can cause a lifetime issue if the matched device is not the expected type, as by the time the caller can introspect the object, it might be gone (the srcu lock having been dropped).

Given that there is only a single user of this helper, the simplest option is to move the locking responsibility to the caller, which can keep the srcu lock held for as long as it wants.

Note that this aligns with other kvm_io_bus*() helpers, which already require the srcu lock to be held by the callers.

AnalysisAI

Improper locking scope in the Linux kernel KVM subsystem exposes a use-after-free race condition through kvm_io_bus_get_dev(), where the function drops the SRCU lock before returning a device pointer, leaving a window in which the referenced object may be freed before the caller can safely inspect it. All Linux kernel versions from the introducing commit (approximately 4.8) through the 7.1 and 6.x stable series are affected until patched releases across eight stable branches are applied. No public exploit has been identified at time of analysis, and the EPSS score of 0.22% reflects a low current probability of exploitation despite the High CVSS severity rating.

Technical ContextAI

The vulnerability is located in the KVM (Kernel-based Virtual Machine) I/O bus dispatch subsystem of the Linux kernel (CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*). KVM uses SRCU (Sleepable Read-Copy-Update) locks to protect the list of registered I/O bus devices from concurrent modification during VM operation. The flaw in kvm_io_bus_get_dev() is that the function performed device address matching and then released the SRCU lock internally before handing a raw device pointer back to the caller. If the returned object was not of the expected type, the caller would need to inspect it post-return - but between the lock release and that inspection, a concurrent path could free the device, producing a use-after-free (UAF) condition rooted in CWE-667 (Improper Locking) rather than a heap allocation bug per se. The fix restructures the API so callers hold the SRCU lock for the lifetime of their device reference, consistent with the contract already imposed by other kvm_io_bus*() helpers. The vulnerability has existed since commit 8a39d00670f0792c1186e442e1dd28fe0326f2ee, and fixes are delivered as individual stable-branch commits, not as a single upstream mainline patch.

RemediationAI

Upgrade to a patched Linux kernel stable release: 5.10.261 or later for the 5.10 LTS series, 5.15.212 or later for the 5.15 LTS series, 6.1.178 or later for the 6.1 LTS series, 6.6.145 or later for the 6.6 LTS series, 6.12.97 or later for the 6.12 series, 6.18.40 or later for the 6.18 series, and 7.1.5 or later for the 7.1 series. Fix commits are available at https://git.kernel.org/stable/c/f398b7d92cd999191249830b9171c9bd787a9a91 and the additional stable tree references listed in the CVE. For systems where immediate kernel upgrade is not feasible, restrict access to /dev/kvm to only explicitly trusted administrative accounts by tightening udev rules or group membership in the 'kvm' group - this removes unprivileged user ability to interact with the KVM I/O bus and significantly limits exploitation surface. Note that this compensating control does not eliminate the underlying race condition and should be treated as a temporary measure only; it also prevents legitimate unprivileged KVM use (e.g., nested virtualization for developer workloads), which must be weighed against the risk.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Not-Affected

Share

CVE-2026-72282 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy