{"cve":"CVE-2026-72306","nvd":{"published":"2026-08-15T06:22:03.330","modified":"2026-08-17T06:18:33.683","status":"Received","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nvduse: Fix race in vduse_dev_msg_sync and vduse_dev_read_iter\n\nThere is one race case in vduse_dev_msg_sync and vduse_dev_read_iter:\n\nvduse_dev_read_iter():\n    lock(msg_lock);\n    dequeue_msg(send_list);\n    unlock(msg_lock);\nvduse_dev_msg_sync():\n    wait_timeout() finish\n    lock(msg_lock);\n    check msg->complete is false\n        list_del(msg);   <- double list_del() crash!\n\nTo fix this case, we shall ensure vduse_msg is on send_list or recv_list\noutside the msg_lock critical section.","cvss_v4":null,"cvss_v3":null,"cwes":[],"references":["https://git.kernel.org/stable/c/09723f26ed801c083e914cec4cc0e1af4b933dc7","https://git.kernel.org/stable/c/3755965adbb617f4283ac6ccd351ed0676843cba","https://git.kernel.org/stable/c/8062ff9d366c4bc4ae775e14eac9a769f20c60dd","https://git.kernel.org/stable/c/ae9c13b6fd79087cc5a216ee1649b6f012c2a238","https://git.kernel.org/stable/c/c83ad3dfa6d9953d5ce6839416bf5a1bfc50285a"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:48:17.459049833+00:00"},"epss":{"cve":"CVE-2026-72306","score":0.00215,"percentile":0.11925,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}