CVE-2026-72305: Linux Kernel VDUSE Information Disclosure

CVE-2026-72305 Overview

CVE-2026-72305 is an information disclosure vulnerability in the Linux kernel's VDUSE (vDPA Device in Userspace) subsystem. The flaw allows kernel memory contents to leak into userspace through bounce pages that are mapped without prior zeroing. Because the bounced region is not necessarily page aligned, residual kernel data outside the bounced range remains visible to the userspace consumer. The upstream fix allocates bounce pages with __GFP_ZERO to eliminate the residual data before mapping.

Critical Impact
A local userspace process interacting with a VDUSE device can read uninitialized kernel memory, exposing potentially sensitive kernel data.

Affected Products

Linux kernel VDUSE subsystem (vDPA Device in Userspace)
Distributions shipping affected upstream kernel versions prior to the referenced stable commits
Virtualization stacks relying on VDUSE for vDPA device emulation

Discovery Timeline

2026-08-15 - CVE-2026-72305 published to NVD
2026-08-23 - Last updated in NVD database

Technical Details for CVE-2026-72305

Vulnerability Analysis

VDUSE enables vDPA devices to be implemented by userspace processes. To bridge DMA between the kernel and userspace, VDUSE uses bounce buffers that are mapped into the userspace address space at page granularity. The vulnerability arises because the bounced I/O region does not have to be aligned to a page boundary. When the kernel allocates the underlying bounce pages without zeroing them, the bytes outside the bounced range still contain whatever data the page previously held. After mapping, userspace can read those bytes and observe kernel information that was never intended to be shared.

This is an information exposure of uninitialized memory [CWE-908, CWE-200]. Exploitation does not corrupt memory or grant code execution, but leaked contents may include kernel pointers, cryptographic material, or data from other processes, weakening kernel address space layout randomization (KASLR) and aiding follow-on local privilege escalation chains.

Root Cause

Bounce pages allocated by the VDUSE driver were not zero-initialized. Because DMA-bounced payloads can start and end at arbitrary offsets within a page, the surrounding bytes retained stale kernel content. Mapping those pages into userspace exposed the stale content. The fix passes __GFP_ZERO to the page allocator so bounce pages are guaranteed to be zeroed before use.

Attack Vector

A local attacker with permission to open a VDUSE control device and instantiate a VDUSE-backed device can trigger I/O that uses bounce buffers, then read the mapped bounce region from userspace. The attacker inspects the bytes surrounding the legitimately bounced range to harvest leftover kernel memory. Exploitation is local and does not require elevated privileges beyond access to the VDUSE interface.

No public proof-of-concept code is currently associated with this CVE. Technical details of the fix are available in the upstream stable tree commits, including Kernel commit 9c152380 and Kernel commit 3ae878f2.

Detection Methods for CVE-2026-72305

Indicators of Compromise

Unexpected userspace processes opening /dev/vduse/control or creating VDUSE devices on hosts that do not normally run vDPA workloads.
Non-root or unprivileged containers acquiring CAP_SYS_ADMIN and interacting with the VDUSE character device.
Anomalous read patterns against mmap regions backing VDUSE bounce buffers.

Detection Strategies

Audit kernel build configuration for CONFIG_VDUSE and inventory hosts that expose the VDUSE interface to userspace.
Enable Linux Audit rules on VDUSE character devices to record open, ioctl, and mmap operations by uid and executable path.
Correlate process telemetry against the kernel version to identify hosts that remain unpatched while executing VDUSE-capable binaries.

Monitoring Recommendations

Track kernel version drift across the fleet and flag nodes still running kernels prior to the referenced stable commits.
Alert on new or uncommon executables invoking VDUSE ioctls, especially outside of known virtualization control planes.
Baseline legitimate vDPA/VDUSE tooling and treat deviations as candidates for investigation.

How to Mitigate CVE-2026-72305

Immediate Actions Required

Apply vendor kernel updates that include the upstream fix zeroing VDUSE bounce pages with __GFP_ZERO.
Restrict access to the VDUSE control device to trusted service accounts and remove it from container images that do not need vDPA.
Where patching is delayed, disable or unload the vduse module on hosts that do not require it.

Patch Information

The fix is present in multiple stable branches of the Linux kernel. Relevant commits include Kernel commit 00335df9, Kernel commit 3ae878f2, Kernel commit 41e27a6a, Kernel commit 5e88c1bc, Kernel commit 690fb82c, Kernel commit 9c152380, and Kernel commit fde25641. Consume the fix through your distribution's stable kernel package.

Workarounds

Unload the module with modprobe -r vduse and blacklist it on systems that do not use vDPA userspace devices.
Constrain the VDUSE device node permissions so only trusted processes can open it.
Prevent container workloads from receiving CAP_SYS_ADMIN or bind-mounting /dev/vduse unless strictly required.

bash

# Disable VDUSE where it is not required
echo 'blacklist vduse' | sudo tee /etc/modprobe.d/disable-vduse.conf
sudo modprobe -r vduse 2>/dev/null || true

# Restrict access to the VDUSE control device if it must remain loaded
sudo chown root:vdpa /dev/vduse/control
sudo chmod 0660 /dev/vduse/control