CVE-2026-74313 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
vduse: hold vduse_lock across IDR lookup in open path
vduse_dev_open() looks up struct vduse_dev through the IDR and then acquires dev->lock only after vduse_lock has been dropped.
This leaves a window where a concurrent VDUSE_DESTROY_DEV can remove the same object from the IDR and free it before the open path locks the device, leading to a use-after-free.
Close this race by keeping vduse_lock held until dev->lock has been acquired in the open path, matching the lock ordering already used by the destroy path.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability in question affects the Linux kernel's virtual distributed unstructured storage engine implementation known as vduse. This subsystem enables virtualized devices to be created and managed through a userspace interface, facilitating communication between kernel space and user space components for storage device emulation. The issue stems from improper lock ordering during device open operations, creating a race condition that can lead to critical memory safety violations. The vulnerability specifically impacts the vduse_dev_open() function which handles the opening of virtual device instances within the kernel's device management framework.
The technical flaw manifests in the sequence of lock acquisition within the device open path where the vduse_lock is released before acquiring the device-specific lock. During this window between releasing the global vduse_lock and acquiring the per-device dev->lock, concurrent execution paths can execute the VDUSE_DESTROY_DEV operation which removes the device structure from the IDR (Integer Descriptor Repository) data structure and subsequently frees the memory. This creates a use-after-free condition where the open path attempts to access a device structure that has already been deallocated by another thread, leading to potential kernel crashes or arbitrary code execution.
The operational impact of this vulnerability extends beyond simple system instability as it represents a critical race condition that can be exploited by malicious actors with access to the virtual device interface. The race condition allows for memory corruption that could potentially be leveraged to escalate privileges within the kernel space, making this a severe security concern for systems utilizing vduse functionality. The vulnerability affects any system running a Linux kernel version containing the problematic code path and is particularly concerning in virtualized environments where multiple concurrent operations on virtual devices occur.
The fix implemented addresses the root cause by modifying the lock ordering to maintain vduse_lock protection until after dev->lock has been successfully acquired, effectively closing the race window. This change ensures that device structures cannot be removed from the IDR and freed while another thread is in the process of opening or accessing them, maintaining proper synchronization between concurrent operations. The solution aligns with established kernel programming practices for lock ordering and follows the principle of acquiring locks in a consistent order to prevent deadlocks while eliminating race conditions. This patch demonstrates adherence to secure coding principles and represents a typical remediation approach for concurrent access violations in kernel subsystems. The fix has been categorized under CWE-362, which specifically addresses Race Conditions, and aligns with ATT&CK technique T1068, which involves exploiting local privilege escalation mechanisms through kernel vulnerabilities.