CVE-2026-72482 gpib: fix double decrement of descriptor_busy in command_ioctl()
A double decrement of a reference counter in the Linux kernel gpib driver allows a use-after-free, potentially enabling code execution or privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-72482?
CVE-2026-72482 is a high-severity use after free vulnerability in Linux, published on 15 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
gpib: fix double decrement of descriptor_busy in command_ioctl()
commit d1857f8296dc ("gpib: fix use-after-free in IO ioctl handlers") introduced a descriptor_busy reference counter to pin struct gpib_descriptor across IO ioctl operations. In command_ioctl(), the error path inside the loop decrements descriptor_busy and breaks, but execution then falls through to the unconditional decrement after the loop, underflowing the counter to -1.
This re-enables the use-after-free that the original fix was meant to prevent: a concurrent close_dev_ioctl() sees descriptor_busy == 0 on an actively-used descriptor and frees it.
Remove the early decrement from the error path. The post-loop decrement already handles all exit paths, matching the correct pattern used in read_ioctl() and write_ioctl().
Which versions are affected by CVE-2026-72482?
How do I fix CVE-2026-72482?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-72482 being exploited?
There is no known exploitation of CVE-2026-72482 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-72482, DEBIAN-CVE-2026-72482, GHSA-g7v6-7vr9-25jq, UBUNTU-CVE-2026-72482.