CVE-2026-72282 json
KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers
published 2026-08-15 2 mo ago modified 2026-10-16 23 d ago also EUVD-2026-59181
- cvss
- 7.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 7%
- public exploits
- 0
- none known
Summary
In the Linux kernel, the following vulnerability has been resolved:
KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers
kvm_io_bus_get_dev() returns a device that is only matched by the address, and nothing else. This can cause a lifetime issue if the matched device is not the expected type, as by the time the caller can introspect the object, it might be gone (the srcu lock having been dropped).
Given that there is only a single user of this helper, the simplest option is to move the locking responsibility to the caller, which can keep the srcu lock held for as long as it wants.
Note that this aligns with other kvm_io_bus*() helpers, which already require the srcu lock to be held by the callers.
Patch / fix
- Linux Linux 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5, 7.2
- linux Debian 12 6.1.180-1
- linux Debian 13 6.12.100-1
- linux Debian 14 7.1.5-1
debian advisories DEBIAN-CVE-2026-72282
- linux Ubuntu 22.04 LTS 5.15.0-198.208
- linux Ubuntu 24.04 LTS 6.8.0-147.147
- linux Ubuntu 26.04 LTS 7.0.0-38.38
- linux-aws Ubuntu 22.04 LTS 5.15.0-1117.124
- linux-aws Ubuntu 24.04 LTS 6.8.0-1067.70
- linux-aws Ubuntu 26.04 LTS 7.0.0-1014.14
- linux-gcp Ubuntu 22.04 LTS 5.15.0-1118.128
- linux-gcp Ubuntu 24.04 LTS 6.8.0-1071.79
ubuntu advisories UBUNTU-CVE-2026-72282
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- kernel-64kb SLE Module for Basesystem 15 SP7 6.4.0-150700.53.84.1
- kernel-syms SLE Module for Development Tools 15 SP7 6.4.0-150700.53.84.1
- kernel-azure SLE Module for Public Cloud 15 SP7 6.4.0-150700.53.84.1
- kernel-source SLE Module for Development Tools 15 SP7, SLE Module for Basesystem 15 SP7 6.4.0-150700.53.84.1
- kernel-default SLE Workstation Extension 15 SP7, SLE Module for Legacy 15 SP7, SLE Module for Basesystem 15 SP7 +2 more 6.4.0-150700.53.84.1
- kernel-zfcpdump SLE Module for Basesystem 15 SP7 6.4.0-150700.53.84.1
- kernel-obs-build SLE Module for Development Tools 15 SP7 6.4.0-150700.53.84.1
- kernel-default-base SLE Module for Basesystem 15 SP7 6.4.0-150700.53.84.1.150700.17.47.1
suse advisories SUSE-SU-2026:4706-1SUSE-SU-2026:4640-1SUSE-SU-2026:24316-1SUSE-SU-2026:24315-1SUSE-SU-2026:24181-1SUSE-SU-2026:24182-1
- kernel-rt openSUSE Leap 16.0 6.12.0-160000.38.1
- dtb-aarch64 openSUSE Leap 16.0 6.12.0-160000.38.1
- kernel-64kb openSUSE Leap 16.0 6.12.0-160000.38.1
- kernel-syms openSUSE Leap 16.0 6.12.0-160000.38.1
- kernel-azure openSUSE Leap 16.0 6.12.0-160000.38.1
- kernel-obs-qa openSUSE Leap 16.0 6.12.0-160000.38.1
- kernel-source openSUSE Leap 16.0 6.12.0-160000.38.1
- kernel-default openSUSE Leap 16.0 6.12.0-160000.38.1
opensuse advisories openSUSE-SU-2026:21910-1
- git.kernel.org/stable/c/f398b7d92cd999191249830b9171c9bd787a9a91 commit
- git.kernel.org/stable/c/1b4a3c2f0509e7b0e65667f3c36676a849ee2755 commit
- git.kernel.org/stable/c/cfe107b02a3c3f049e0dc15b6a36625f048eda2a commit
- git.kernel.org/stable/c/90d35d2b8e47afd68fe2a4dd0eeb60bc71641775 commit
- git.kernel.org/stable/c/e01071ea006c9b952125ed8b0cc90ac7bd356cce commit
- git.kernel.org/stable/c/7099e7148f81c605bbc319b16ce0131540341560 commit
- git.kernel.org/stable/c/0cbae0e296d27ce4c4cce83e34d40c2bfd8133aa commit
- git.kernel.org/stable/c/3a07249981629ace483ebbef81ef6b34c2d2afec commit
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2026-72282 updated cvss 7.0
kernel: KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers
-
Red Hat Enterprise Linux 8 perf, kernel, bpftool, kernel-rt, kernel-core, kernel-tools, +29 more Red Hat Enterprise Linux 9 rv, perf, rtla, kernel, bpftool, libperf, +83 more Red Hat Enterprise Linux 10 kernelaffected: workaround, no fix available
-
Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 morenot affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 23 d ago
Exploit prediction
0.18% chance of exploitation in the next 30 days, higher than 7% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Affected products
- Linux Linux
Classification
- Technology feeds
References
- git.kernel.org /stable/c/f398b7d92cd999191249830b9171c9bd787a9a91
- git.kernel.org /stable/c/1b4a3c2f0509e7b0e65667f3c36676a849ee2755
- git.kernel.org /stable/c/cfe107b02a3c3f049e0dc15b6a36625f048eda2a
- git.kernel.org /stable/c/90d35d2b8e47afd68fe2a4dd0eeb60bc71641775
- git.kernel.org /stable/c/e01071ea006c9b952125ed8b0cc90ac7bd356cce
- git.kernel.org /stable/c/7099e7148f81c605bbc319b16ce0131540341560
- git.kernel.org /stable/c/0cbae0e296d27ce4c4cce83e34d40c2bfd8133aa
- git.kernel.org /stable/c/3a07249981629ace483ebbef81ef6b34c2d2afec
Sources
- CVE List CVE-2026-72282
- NVD CVE-2026-72282
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.