EUVD-2026-59460
GHSA-m274-mg38-f4wj
Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
AC:H reflects race-condition timing requirement; AV:L and PR:L confirmed by local VDUSE device access prerequisite; S:C retained due to kernel-level impact from userspace.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
vduse: hold vduse_lock across IDR lookup in open path
vduse_dev_open() looks up struct vduse_dev through the IDR and then acquires dev->lock only after vduse_lock has been dropped.
This leaves a window where a concurrent VDUSE_DESTROY_DEV can remove the same object from the IDR and free it before the open path locks the device, leading to a use-after-free.
Close this race by keeping vduse_lock held until dev->lock has been acquired in the open path, matching the lock ordering already used by the destroy path.
AnalysisAI
Use-after-free in the Linux kernel VDUSE (vDPA Device in Userspace) subsystem allows a local low-privileged user to corrupt kernel memory and escalate privileges to full kernel control. The flaw exists in vduse_dev_open(), which releases vduse_lock after an IDR lookup but before acquiring dev->lock, creating a race window where a concurrent VDUSE_DESTROY_DEV ioctl can remove and free the same struct vduse_dev object - causing the open path to later dereference freed memory. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The VDUSE kernel subsystem must be loaded (CONFIG_VDUSE=m or =y) and a VDUSE device must exist in the IDR at the time of exploitation. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.8 with AV:L/AC:L/PR:L/S:C/C:H/I:H/A:H reflects kernel-level impact (scope change) achievable by a low-privileged local user, which is realistic for shared Linux systems, containers with VDUSE access, or VMs with virtio device userspace backends. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local user with access to the VDUSE device node opens /dev/vduse while a privileged management process concurrently issues VDUSE_DESTROY_DEV for the same device. If the attacker's open() call retrieves the struct vduse_dev pointer from the IDR just before the destroy ioctl frees it, the kernel subsequently dereferences freed memory when acquiring dev->lock, enabling type-confusion or controlled write primitives for kernel privilege escalation. … |
| Remediation | The primary remediation is to upgrade to the patched kernel version for the relevant stable branch: 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5, or 7.2-rc1, applying the upstream fix commits published at https://git.kernel.org/stable/c/35483c5306e09b3190ff937089d404a78012695c and the corresponding per-branch commits. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Linux systems running vulnerable kernel versions per vendor advisory and document local user distribution across affected hosts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today