CVE-2026-72306 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
vduse: Fix race in vduse_dev_msg_sync and vduse_dev_read_iter
There is one race case in vduse_dev_msg_sync and vduse_dev_read_iter:
vduse_dev_read_iter(): lock(msg_lock); dequeue_msg(send_list); unlock(msg_lock); vduse_dev_msg_sync(): wait_timeout() finish lock(msg_lock); check msg->complete is false list_del(msg); <- double list_del() crash!
To fix this case, we shall ensure vduse_msg is on send_list or recv_list outside the msg_lock critical section.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability resides in the Linux kernel's virtual device use (vduse) subsystem where a race condition exists between two critical functions that handle message synchronization and reading operations. This issue manifests as a double list deletion crash occurring during concurrent execution of vduse_dev_msg_sync and vduse_dev_read_iter functions, creating a dangerous scenario where memory corruption can occur through improper list management. The race condition stems from the lack of proper synchronization mechanisms ensuring exclusive access to shared data structures during message processing.
The technical flaw involves a classic race condition in kernel space programming where two concurrent threads execute different code paths that manipulate the same linked list structure without adequate locking mechanisms. In the vduse_dev_read_iter function, a message is dequeued from the send_list while holding msg_lock, but immediately after releasing the lock, the vduse_dev_msg_sync function attempts to process the same message object. When the sync function checks for message completion and finds it false, it proceeds to delete the message from the list, potentially causing a double deletion when the read_iter function also attempts to remove the same message from its list.
This vulnerability directly maps to CWE-367, which describes Time-of-Check to Time-of-Use (TOCTOU) race conditions in kernel space operations. The flaw represents a critical security issue that could be exploited by malicious actors to cause system crashes or potentially achieve privilege escalation through memory corruption. The operational impact extends beyond simple denial of service as it affects the stability of virtualized device implementations within the Linux kernel ecosystem, particularly affecting systems relying on vduse for virtualization scenarios.
The remediation approach requires implementing proper synchronization mechanisms that ensure message objects are either exclusively on the send_list or recv_list outside of critical sections. This involves reworking the locking strategy to prevent concurrent access patterns that lead to double list deletions and ensuring that all message lifecycle management operations maintain atomicity with respect to shared data structures. The fix should align with kernel security best practices outlined in the Linux kernel security documentation and follow ATT&CK technique T1499 for system network denial of service, as this vulnerability creates a potential pathway for system instability through improper resource management.
The broader implications of this vulnerability highlight the importance of rigorous concurrent programming practices in kernel space where memory safety violations can have catastrophic consequences. This particular flaw demonstrates how seemingly simple list operations can become complex when multiple threads interact with shared data structures without proper synchronization primitives, emphasizing the need for comprehensive testing methodologies that include race condition detection and proper locking protocol implementation within kernel subsystems.