CVE-2026-74313
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
In the Linux kernel, vduse_dev_open() has a race condition between IDR lookup and acquiring the device lock. An attacker can exploit the window where VDUSE_DESTROY_DEV removes and frees the object before the open path locks it, leading to use-after-free.
Risk Assessment
The vulnerability may lead to kernel memory corruption, potentially resulting in privilege escalation or system crash (DoS).
Recommendation
Apply the official Linux kernel patch that holds vduse_lock until dev->lock is acquired in the open path, eliminating the race window.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: vduse: hold vduse_lock across IDR lookup in open path vduse_dev_open() looks up struct vduse_dev through the IDR and then acquires dev->lock only after vduse_lock has been dropped. This leaves a window where a concurrent VDUSE_DESTROY_DEV can remove the same object from the IDR and free it before the open path locks the device, leading to a use-after-free. Close this race by keeping vduse_lock held until dev->lock has been acquired in the open path, matching the lock ordering already used by the destroy path.