What is the CVSS score of CVE-2026-72482?

CVE-2026-72482 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-72482?

Linux kernel versions 6.18.22-6.18.39 and 7.0 contain a use-after-free vulnerability in the GPIB driver that could allow local attackers with low-privilege access to cause kernel denial of service or…. A patch is available.

How to fix or mitigate CVE-2026-72482?

Within 24 hours, identify all systems running Linux kernel versions 6.18.22 through 6.18.39 or version 7.0 with GPIB drivers enabled; inventory affected infrastructure and prioritize systems with sensitive workloads or multiple user accounts. Within 7 days, deploy kernel patches: upgrade to Linux 6.18.40, 7.1.5, or 7.2-rc1 across affected systems through your standard patch management process, prioritizing production servers first. Within 30 days, complete remediation across all affected infrastructure and verify patch deployment through kernel version auditing.

Linux Kernel CVE-2026-72482

EUVD-2026-59381 HIGH

2026-08-15 Linux

GHSA-g7v6-7vr9-25jq

Information Disclosure Linux Red Hat Suse

7.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Race condition between concurrent ioctl paths warrants AC:H over the vendor-assigned AC:L; all other metrics align with local low-privilege access and full kernel impact.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Red Hat

5.5 MEDIUM

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 09:46 vuln.today

CVSS changed

Aug 17, 2026 - 06:22 NVD

7.8 (HIGH)

Patch available

Aug 15, 2026 - 07:20 EUVD

CVE Published

Aug 15, 2026 - 05:57 cve.org

HIGH 7.8

CVE Published

Aug 15, 2026 - 05:57 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

gpib: fix double decrement of descriptor_busy in command_ioctl()

commit d1857f8296dc ("gpib: fix use-after-free in IO ioctl handlers") introduced a descriptor_busy reference counter to pin struct gpib_descriptor across IO ioctl operations. In command_ioctl(), the error path inside the loop decrements descriptor_busy and breaks, but execution then falls through to the unconditional decrement after the loop, underflowing the counter to -1.

This re-enables the use-after-free that the original fix was meant to prevent: a concurrent close_dev_ioctl() sees descriptor_busy == 0 on an actively-used descriptor and frees it.

Remove the early decrement from the error path. The post-loop decrement already handles all exit paths, matching the correct pattern used in read_ioctl() and write_ioctl().

AnalysisAI

Double-decrement of the descriptor_busy reference counter in the Linux kernel's GPIB driver re-introduces a use-after-free condition that a prior security patch (commit d1857f8296dc) was specifically designed to prevent. Affected kernels include the 6.18.22-6.18.39 range and Linux 7.0, with patched releases available at 6.18.40, 7.1.5, and 7.2-rc1. Exploitation requires a local low-privilege account and access to GPIB device nodes; no public exploit code has been identified at time of analysis, and the EPSS score of 0.19% reflects negligible observed exploitation activity.

Technical ContextAI

The Linux kernel's GPIB (General Purpose Interface Bus / IEEE-488) driver implements ioctl handlers for scientific instrumentation bus control. Commit d1857f8296dc introduced a descriptor_busy reference counter to safely pin struct gpib_descriptor across concurrent I/O ioctl operations, preventing premature freeing by close_dev_ioctl(). In command_ioctl(), the error path inside the processing loop performs an early decrement of descriptor_busy and then breaks out of the loop - but execution subsequently falls through to an unconditional post-loop decrement, causing the counter to underflow to -1. When close_dev_ioctl() evaluates the underflowed value as equivalent to zero, it incorrectly concludes the descriptor is idle and frees it while command_ioctl() still holds a live reference, resulting in a use-after-free. The correct pattern used by read_ioctl() and write_ioctl() relies solely on the post-loop decrement. Affected CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* across multiple stable kernel branches as documented in EUVD-2026-59381.

RemediationAI

Upgrade to Linux kernel 6.18.40 or 7.1.5 (or later, including 7.2-rc1), which incorporate the fix removing the erroneous early decrement of descriptor_busy from the command_ioctl() error path. The upstream stable commits are available at https://git.kernel.org/stable/c/c4faab452b3c1ada003d49c477609dd80523b9bf (6.18 branch), https://git.kernel.org/stable/c/8b5f1d295dda8677e4545ce340053fcfa8b634c7 (parallel 6.18 stream), and https://git.kernel.org/stable/c/fdee9f207a48ce204ec6cfceaa1459d2473600a5 (7.x branch). For systems that cannot be patched immediately, restrict access to GPIB device nodes (typically /dev/gpib*) via udev rules or filesystem permissions to prevent unprivileged users from issuing ioctl commands - this eliminates the PR:L attack path but blocks legitimate GPIB access for non-root users. Alternatively, if GPIB hardware is not in active use, blacklisting the gpib_common module (e.g., adding it to /etc/modprobe.d/blacklist.conf) fully eliminates the attack surface with no functional impact on non-GPIB workloads.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

CVE-2026-72482 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-72482

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code