CVE-2026-72306 vduse: Fix race in vduse_dev_msg_sync and vduse_dev_read_iter
A race condition in the Linux kernel's vduse driver can cause a double list deletion, leading to a system crash.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-72306?
CVE-2026-72306 is a vulnerability in Linux, published on 15 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
vduse: Fix race in vduse_dev_msg_sync and vduse_dev_read_iter
There is one race case in vduse_dev_msg_sync and vduse_dev_read_iter:
vduse_dev_read_iter(): lock(msg_lock); dequeue_msg(send_list); unlock(msg_lock); vduse_dev_msg_sync(): wait_timeout() finish lock(msg_lock); check msg->complete is false list_del(msg); <- double list_del() crash!
To fix this case, we shall ensure vduse_msg is on send_list or recv_list outside the msg_lock critical section.
Which versions are affected by CVE-2026-72306?
How do I fix CVE-2026-72306?
Apply the vendor's patch.
Is CVE-2026-72306 being exploited?
There is no known exploitation of CVE-2026-72306 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-72306, DEBIAN-CVE-2026-72306, GHSA-p7f7-389q-3p34, UBUNTU-CVE-2026-72306.