CVE-2026-72305 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
VDUSE: avoid leaking information to userspace
The bounceing is not necessarily page aligned, so current VDUSE can leak kernel information through mapping bounce pages to userspace. Allocate bounce pages with __GFP_ZERO to avoid leaking information to userspace.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability in question affects the Linux kernel's virtual device driver subsystem known as VDUSE which provides virtualized hardware interfaces to user space applications. This particular flaw represents a critical information disclosure issue that could potentially allow malicious user space processes to extract sensitive kernel memory contents through improper handling of bounce pages during device I/O operations. The vulnerability stems from insufficient memory initialization practices within the kernel's memory allocation routines for virtual device drivers.
The technical root cause lies in the improper allocation of bounce pages used for data transfer between kernel and user space contexts. Bounce pages serve as temporary buffers when direct memory access is not possible or secure, but in this case the allocation does not guarantee that the pages are properly initialized with zero values. The vulnerability specifically occurs because the bouncing mechanism is not necessarily page aligned, creating potential for information leakage where uninitialized memory contents from kernel pages could be mapped into user space mappings. This misalignment allows for partial exposure of kernel data structures, stack contents, or other sensitive information that may have been previously stored in those memory regions.
The operational impact of this vulnerability extends beyond simple information disclosure as it creates a potential attack vector for privilege escalation and system compromise. An attacker with access to a VDUSE device could leverage this flaw to gather kernel memory contents including cryptographic keys, passwords, or other sensitive data that should remain protected from user space access. The vulnerability is particularly concerning in multi-tenant environments where multiple users share the same physical hardware, as it could enable one user to extract information belonging to another user or system processes. This aligns with CWE-248, an information exposure weakness that occurs when a program exposes internal state information to unauthorized parties.
The recommended mitigation involves modifying the memory allocation strategy for bounce pages by using the __GFP_ZERO flag during allocation. This flag ensures that allocated pages are explicitly initialized to zero before being returned to the caller, effectively preventing any leakage of kernel memory contents. The solution directly addresses the fundamental issue by guaranteeing that no uninitialized kernel data remains accessible through user space mappings. Implementation of this fix requires modifications to the VDUSE subsystem's memory management routines where bounce pages are allocated and managed.
This vulnerability demonstrates the importance of proper memory initialization practices in kernel code, particularly when dealing with shared memory interfaces between kernel and user space domains. The flaw highlights the need for comprehensive security testing of virtualization and device driver subsystems where memory sharing occurs across privilege boundaries. From an attack perspective this vulnerability aligns with techniques described in the MITRE ATT&CK framework under T1068, which covers local privilege escalation through kernel exploits, and T1552, covering data manipulation through information disclosure methods.
The fix implementation should be carefully tested to ensure it does not introduce performance regressions or break existing functionality. Kernel developers must verify that all VDUSE allocation paths properly utilize the __GFP_ZERO flag and that the change does not affect other subsystems that might rely on uninitialized memory behavior. This type of vulnerability underscores the critical importance of security by design principles in kernel development, where proper initialization and memory management practices prevent information leakage that could be exploited by malicious actors. The solution represents a defensive programming approach that follows established best practices for protecting sensitive kernel data from unauthorized access through improper memory handling mechanisms.