CVE-2026-97983

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-97983", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:18:58.208Z", "datePublished": "2026-09-25T10:23:18.940Z", "dateUpdated": "2026-10-19T09:11:50.328Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:11:50.328Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvduse: return compat ioctl results directly\n\nThe compat handler handles VDUSE_IOTLB_GET_FD and VDUSE_VQ_GET_INFO, but\nthen calls the native handler. Their different command sizes make native\ndispatch return -ENOIOCTLCMD.\n\nFor GET_FD, this overwrites receive_fd()'s return value after the\ndescriptor is installed, leaking one fd per call. Return handled compat\nresults directly and use native dispatch only for other commands."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/vdpa/vdpa_user/vduse_dev.c"], "versions": [{"version": "455a2a1af92651764e9eb42cec0d95ac142afc28", "lessThan": "135ac58097fa5fc707bf392c5cececf59e4080c0", "status": "affected", "versionType": "git"}, {"version": "455a2a1af92651764e9eb42cec0d95ac142afc28", "lessThan": "48a4ee65e677559776349128e6a81a6041986c99", "status": "affected", "versionType": "git"}, {"version": "7dd28904c42ee3b0728c0692dd3332c2c83e8f33", "status": "affected", "versionType": "git"}, {"version": "7.1.5", "lessThan": "7.2", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/vdpa/vdpa_user/vduse_dev.c"], "versions": [{"version": "7.2", "status": "affected"}, {"version": "0", "lessThan": "7.2", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.7", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.2", "versionEndExcluding": "7.2.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.2", "versionEndExcluding": "7.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.1.5"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/135ac58097fa5fc707bf392c5cececf59e4080c0"}, {"url": "https://git.kernel.org/stable/c/48a4ee65e677559776349128e6a81a6041986c99"}], "title": "vduse: return compat ioctl results directly", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/vdpa/vdpa_user/vduse_dev.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "135ac58097fa5fc707bf392c5cececf59e4080c0", "status": "affected", "version": "455a2a1af92651764e9eb42cec0d95ac142afc28", "versionType": "git"}, {"lessThan": "48a4ee65e677559776349128e6a81a6041986c99", "status": "affected", "version": "455a2a1af92651764e9eb42cec0d95ac142afc28", "versionType": "git"}, {"status": "affected", "version": "7dd28904c42ee3b0728c0692dd3332c2c83e8f33", "versionType": "git"}, {"lessThan": "7.2", "status": "affected", "version": "7.1.5", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/vdpa/vdpa_user/vduse_dev.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "7.2"}, {"lessThan": "7.2", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvduse: return compat ioctl results directly\n\nThe compat handler handles VDUSE_IOTLB_GET_FD and VDUSE_VQ_GET_INFO, but\nthen calls the native handler. Their different command sizes make native\ndispatch return -ENOIOCTLCMD.\n\nFor GET_FD, this overwrites receive_fd()'s return value after the\ndescriptor is installed, leaking one fd per call. Return handled compat\nresults directly and use native dispatch only for other commands."}], "id": "CVE-2026-97983", "lastModified": "2026-10-19T10:17:49.663", "metrics": {}, "published": "2026-09-25T11:17:26.340", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/135ac58097fa5fc707bf392c5cececf59e4080c0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/48a4ee65e677559776349128e6a81a6041986c99"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: vduse: return compat ioctl results directly", "id": "2541170", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2541170"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-772", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nvduse: return compat ioctl results directly\nThe compat handler handles VDUSE_IOTLB_GET_FD and VDUSE_VQ_GET_INFO, but\nthen calls the native handler. Their different command sizes make native\ndispatch return -ENOIOCTLCMD.\nFor GET_FD, this overwrites receive_fd()'s return value after the\ndescriptor is installed, leaking one fd per call. Return handled compat\nresults directly and use native dispatch only for other commands.", "A flaw was found in the Linux kernel's VDUSE (vDPA Device in Userspace) subsystem. A local user can cause a Denial of Service (DoS) by issuing specific 32-bit compatibility input/output control (ioctl) requests. Due to improper command dispatching, successful requests allocate file descriptors but return an error, leaking a descriptor on each call. Repeated invocations can exhaust available system file descriptors and disrupt operating system services."], "name": "CVE-2026-97983", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-97983\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-97983\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-97983.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[455a2a1af92651764e9eb42cec0d95ac142afc28,135ac58097fa5fc707bf392c5cececf59e4080c0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[455a2a1af92651764e9eb42cec0d95ac142afc28,48a4ee65e677559776349128e6a81a6041986c99)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "7dd28904c42ee3b0728c0692dd3332c2c83e8f33"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[7.1.5,7.2)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.2"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,7.2)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.7,8.0.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.3-rc3,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-25T14:30:14.459004+00:00", "updated": "2026-10-01T07:15:05.002688+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-772"]}