Skip to content
Heist/ feed
Back to feed
UnratedFix available

vduse: return compat ioctl results directly

Type: advisorySources: OSV

In the Linux kernel, the following vulnerability has been resolved: vduse: return compat ioctl results directly The compat handler handles VDUSE_IOTLB_GET_FD and VDUSE_VQ_GET_INFO, but then calls the native handler. Their different command sizes make native dispatch return -ENOIOCTLCMD. For GET_FD, this overwrites receive_fd()'s return value after the descriptor is installed, leaking one fd per call. Return handled compat results directly and use native dispatch only for other commands.

Products
Kernel
Affected versions
Not specified
Fixed versions
7.2.7
CVEs
CVE-2026-97983
Confirmed fixed CVEs
Not specified
Updated in this feed
8 Nov 2026, 02:32 UTC · Revision 1

Source evidence

vduse: return compat ioctl results directly

core-osv · Original source

Published 25 Sept 2026, 10:23 UTC

In the Linux kernel, the following vulnerability has been resolved: vduse: return compat ioctl results directly The compat handler handles VDUSE_IOTLB_GET_FD and VDUSE_VQ_GET_INFO, but then calls the native handler. Their different command sizes make native dispatch return -ENOIOCTLCMD. For GET_FD, this overwrites receive_fd()'s return value after the descriptor is installed, leaking one fd per call. Return handled compat results directly and use native dispatch only for other commands.

osv:CVE-2026-97983

Kernel

Fixed versions: 7.2.7

Complete source record
{
  "id": "e0342b59d28b38b2ea4b7b6003add37a9eac8e57e5460350b22d118aacb89df6",
  "url": "https://osv.dev/vulnerability/CVE-2026-97983",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "vduse: return compat ioctl results directly",
    "summary": "In the Linux kernel, the following vulnerability has been resolved: vduse: return compat ioctl results directly The compat handler handles VDUSE_IOTLB_GET_FD and VDUSE_VQ_GET_INFO, but then calls the native handler. Their different command sizes make native dispatch return -ENOIOCTLCMD. For GET_FD, this overwrites receive_fd()'s return value after the descriptor is installed, leaking one fd per call. Return handled compat results directly and use native dispatch only for other commands.",
    "evidence": "osv:CVE-2026-97983",
    "products": [
      {
        "name": {
          "value": "Kernel",
          "evidence": "/affected/1/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "7.2.7",
            "evidence": "/affected/1/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "CVE-2026-97983",
      "aliases": [
        "CVE-2026-97983"
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "455a2a1af92651764e9eb42cec0d95ac142afc28"
                },
                {
                  "fixed": "135ac58097fa5fc707bf392c5cececf59e4080c0"
                },
                {
                  "fixed": "48a4ee65e677559776349128e6a81a6041986c99"
                }
              ]
            },
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "7.1.5"
                },
                {
                  "fixed": "7.2"
                }
              ]
            },
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "7dd28904c42ee3b0728c0692dd3332c2c83e8f33"
                }
              ]
            }
          ],
          "versions": [
            "v7.1.13",
            "v7.1.12",
            "v7.1.11",
            "v7.1.10",
            "v7.1.9",
            "v7.1.8",
            "v7.1.7",
            "v7.1.6",
            "v7.1.5"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-97983.json"
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "7.2.0"
                },
                {
                  "fixed": "7.2.7"
                }
              ]
            }
          ],
          "package": {
            "name": "Kernel",
            "ecosystem": "Linux"
          },
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-97983.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:52.779220842Z",
      "provider": "osv",
      "references": [
        "https://git.kernel.org/stable/c/135ac58097fa5fc707bf392c5cececf59e4080c0",
        "https://git.kernel.org/stable/c/48a4ee65e677559776349128e6a81a6041986c99",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/97xxx/CVE-2026-97983.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-97983",
        "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
      ],
      "provider_metadata": {
        "cna_assigner": "Linux",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/97xxx/CVE-2026-97983.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-97983",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 521814,
  "published_at": "2026-09-25T10:23:18.94+00:00"
}