CVE-2026-97983

Full vulnerability record from the local CVENow database.

Description

In the Linux kernel, the following vulnerability has been resolved: vduse: return compat ioctl results directly The compat handler handles VDUSE_IOTLB_GET_FD and VDUSE_VQ_GET_INFO, but then calls the native handler. Their different command sizes make native dispatch return -ENOIOCTLCMD. For GET_FD, this overwrites receive_fd()'s return value after the descriptor is installed, leaking one fd per call. Return handled compat results directly and use native dispatch only for other commands.

Severity

Not scored

CVSS score

Not available

Vulnerability status

Received

Source identifier

416baaa9-dc9f-4396-8d5f-8c081fb06d67

Published

2026-09-25 11:17:26.340000

Last modified

2026-10-19 10:17:49.663000

View original CVE JSON

{
  "id": "CVE-2026-97983",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "published": "2026-09-25T11:17:26.340",
  "lastModified": "2026-10-19T10:17:49.663",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvduse: return compat ioctl results directly\n\nThe compat handler handles VDUSE_IOTLB_GET_FD and VDUSE_VQ_GET_INFO, but\nthen calls the native handler. Their different command sizes make native\ndispatch return -ENOIOCTLCMD.\n\nFor GET_FD, this overwrites receive_fd()'s return value after the\ndescriptor is installed, leaking one fd per call. Return handled compat\nresults directly and use native dispatch only for other commands."
    }
  ],
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "programFiles": [
            "drivers/vdpa/vdpa_user/vduse_dev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "455a2a1af92651764e9eb42cec0d95ac142afc28",
              "lessThan": "135ac58097fa5fc707bf392c5cececf59e4080c0",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "455a2a1af92651764e9eb42cec0d95ac142afc28",
              "lessThan": "48a4ee65e677559776349128e6a81a6041986c99",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "7dd28904c42ee3b0728c0692dd3332c2c83e8f33",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "7.1.5",
              "lessThan": "7.2",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "programFiles": [
            "drivers/vdpa/vdpa_user/vduse_dev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "7.2",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "7.2",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "7.2.7",
              "lessThanOrEqual": "7.2.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "7.3",
              "lessThanOrEqual": "*",
              "versionType": "original_commit_for_fix",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {},
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/135ac58097fa5fc707bf392c5cececf59e4080c0",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/48a4ee65e677559776349128e6a81a6041986c99",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ]
}