CVE-2026-72283 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
KVM: x86: Nullify irqfd->producer if updating IRTE for bypass fails
Nullify irqfd->producer if updating the IRTE for bypass fails, as leaving a dangling pointer will result in a use-after-free if the irqfd is reachable through KVM's routing, but the producer is freed separately. E.g. for VFIO PCI, the producer is embedded in struct "vfio_pci_irq_ctx" and freed when the vector is disabled, which can happen independent of routing updates.
[sean: drop PPC change, massage changelog]
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/15/2026
This vulnerability exists within the Linux kernel's KVM virtualization subsystem, specifically affecting x86 architecture implementations. The issue stems from improper handling of interrupt file descriptor (irqfd) management during Interrupt Redirection Table Entry (IRTE) updates for bypass operations. When the system attempts to update an IRTE for bypass functionality but encounters a failure, the irqfd->producer pointer remains uninitialized rather than being properly nullified.
The technical flaw manifests as a use-after-free condition that occurs when the irqfd structure is still reachable through KVM's interrupt routing mechanisms while the underlying producer object has already been freed. This creates a scenario where memory that was previously allocated and used for interrupt handling becomes accessible after deallocation, leading to potential memory corruption and system instability. The vulnerability particularly affects virtualization environments where VFIO PCI devices are utilized, as these devices manage interrupt contexts through embedded structures within vfio_pci_irq_ctx.
The operational impact of this vulnerability extends beyond simple memory management issues to potentially compromise the integrity of virtualized systems. When the producer object is freed independently from routing updates, typically during vector disable operations in VFIO PCI implementations, the dangling pointer reference can be dereferenced at a later time. This creates opportunities for attackers to exploit the use-after-free condition to execute arbitrary code or cause denial of service within the virtualization environment.
According to CWE classification, this represents a CWE-416 Use After Free vulnerability, which occurs when a program continues to reference memory after it has been freed. The ATT&CK framework would categorize this under TA0005 Defense Evasion and TA0004 Privilege Escalation techniques, as successful exploitation could allow adversaries to manipulate virtualization layer components. The fix implemented addresses the root cause by ensuring that irqfd->producer is explicitly nullified when IRTE bypass updates fail, thereby preventing access to freed memory structures.
Mitigation strategies should focus on applying the kernel patch that implements proper nullification of the producer pointer upon IRTE update failures. System administrators should prioritize updating their virtualization environments to versions containing this fix, particularly in production systems running KVM with VFIO PCI devices. Additional monitoring should be implemented to detect potential exploitation attempts targeting memory corruption vulnerabilities in virtualization layers, as these issues often serve as stepping stones for more sophisticated attacks. The vulnerability demonstrates the critical importance of proper resource management in virtualized environments where multiple subsystems interact through shared data structures.