CVE-2026-97983 Linux CVE debrief

Who should care

Linux kernel maintainers, administrators, and users who rely on Linux kernel versions that include the vulnerable code should assess exposure and apply patches. The vulnerability affects Linux kernel versions that include the vulnerable code. The compat handler handles VDUSE_IOTLB_GET_FD and VDUSE_VQ_GET_INFO, but then calls the native handler. Their different command sizes make native dispatch return -ENOIOCTLCMD. For GET_FD, this overwrites receive_fd()'

Why it matters

A vulnerability in the Linux kernel's vduse compat handler can cause a file descriptor leak, potentially leading to denial of service. Linux kernel maintainers, administrators, and users should assess exposure and apply patches.

• File descriptor leak in Linux kernel versions that include the vulnerable code
• Potential denial of service due to file descriptor exhaustion

Technical summary

The Linux kernel's vduse compat handler was not returning results directly, causing a file descriptor leak. This issue has been resolved with a patch. The compat handler handles VDUSE_IOTLB_GET_FD and VDUSE_VQ_GET_INFO, but then calls the native handler. Their different command sizes make native dispatch return -ENOIOCTLCMD. For GET_FD, this overwrites receive_fd()'s return value after the descriptor is installed, leaking one fd per call. The patch fixes this issue by returning handled compat results directly and using native dispatch only for other commands

Defensive priority

Assess exposure and apply patches for Linux kernel versions that include the vulnerable code.

Recommended defensive actions

• Assess Linux kernel versions for exposure
• Apply patches for affected Linux kernel versions
• Monitor for potential file descriptor leaks
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. The Linux kernel patch notes indicate a fix for a file descriptor leak in the vduse compat handler. The patch notes also mention that the compat handler handles VDUSE_IOTLB_GET_FD and VDUSE_VQ_GET_INFO, but then calls the native handler. Their different command sizes make native dispatch return -ENOIOCTLCMD. For GET_FD, this overwrites receive_fd()'s return value after the descriptor is installed, leaking one fd per call. The vulnerability has been fixed

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.