CVE-2026-97983

CVE-2026-97983

published September 25, 2026

CVSS
—
EPSS
0%
Percentile
4.3
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

vduse: return compat ioctl results directly

The compat handler handles VDUSE_IOTLB_GET_FD and VDUSE_VQ_GET_INFO, but

then calls the native handler. Their different command sizes make native

dispatch return -ENOIOCTLCMD.

For GET_FD, this overwrites receive_fd()'s return value after the

descriptor is installed, leaking one fd per call. Return handled compat

results directly and use native dispatch only for other commands.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00155 · 4.3th percentile
Published
2026-09-25T15:17Z
References (2)
EPSS history
Timeline
  • 27 SEP 03:28Z
    EPSS moved — → 0%
    epss
  • 25 SEP 10:23Z
    vduse: return compat ioctl results directly
    cvelistv5