{"affected":[{"defaultStatus":"unaffected","product":"Linux","source":"CNA: Linux","vendor":"Linux","versions":[{"lessThan":"52dc40ef0cfee6ae89b7524967e73f0ba37906d7","status":"affected","version":"68b025c813c2eb41ff25628e3d4952d5185eb1a4","versionType":"git"},{"lessThan":"1dd9cb98fe228e017fff9efb33862ff38c741b65","status":"affected","version":"68b025c813c2eb41ff25628e3d4952d5185eb1a4","versionType":"git"},{"lessThan":"6df926130aee6cab9b5d2e5b7862e49ccac348dc","status":"affected","version":"68b025c813c2eb41ff25628e3d4952d5185eb1a4","versionType":"git"},{"lessThan":"311011f8cc206c5af2877b03e3f627ee1b8fe024","status":"affected","version":"68b025c813c2eb41ff25628e3d4952d5185eb1a4","versionType":"git"},{"lessThan":"18a693733f7ad004e1ab0466693121ca70cd95dd","status":"affected","version":"68b025c813c2eb41ff25628e3d4952d5185eb1a4","versionType":"git"},{"lessThan":"16d3ccdabb8dee9be2cdcd6d3f9a125572ec0454","status":"affected","version":"68b025c813c2eb41ff25628e3d4952d5185eb1a4","versionType":"git"},{"lessThan":"6883269a323609f68f6faa903f8f8ff3d191cec8","status":"affected","version":"68b025c813c2eb41ff25628e3d4952d5185eb1a4","versionType":"git"},{"lessThan":"45ca1afe2fd14c04e37227e79d3f8455831d8408","status":"affected","version":"68b025c813c2eb41ff25628e3d4952d5185eb1a4","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","source":"CNA: Linux","vendor":"Linux","versions":[{"status":"affected","version":"2.6.39"},{"lessThan":"2.6.39","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.261","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.212","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.178","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.145","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.97","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.40","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.5","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"cveId":"CVE-2026-72138","cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nxen/gntdev: fix error handling in ioctl\n\nWhen gntdev_ioctl_map_grant_ref() fails to copy the operation result\nback to userspace after successfully adding the mapping to the list,\nthe error path returns -EFAULT without releasing the reference\nacquired by gntdev_alloc_map(). The mapping remains in priv->maps\nwith a refcount of 1, causing a memory leak and a dangling list\nentry.\n\nAdditionally, gntdev_add_map() may modify map->index to avoid overlap\nwith existing mappings. Therefore, the index returned to userspace\nmust be obtained after gntdev_add_map() completes.\n\nFix this by holding the mutex across gntdev_add_map(), retrieving\nthe correct index, and copy_to_user(). If copy_to_user() fails,\nremove the mapping from the list and release the reference while\nstill holding the lock.\n\n\nFix these issues by properly handling all error cases.","epss":{"date":"2026-11-06","percentile":0.12136,"score":0.00216},"exploits":[],"kev":null,"metrics":[],"modifiedAt":1793985577850,"publishedAt":1786773192549,"references":[{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/52dc40ef0cfee6ae89b7524967e73f0ba37906d7"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/1dd9cb98fe228e017fff9efb33862ff38c741b65"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/6df926130aee6cab9b5d2e5b7862e49ccac348dc"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/311011f8cc206c5af2877b03e3f627ee1b8fe024"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/18a693733f7ad004e1ab0466693121ca70cd95dd"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/16d3ccdabb8dee9be2cdcd6d3f9a125572ec0454"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/6883269a323609f68f6faa903f8f8ff3d191cec8"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/45ca1afe2fd14c04e37227e79d3f8455831d8408"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"url":"https://git.kernel.org/stable/c/16d3ccdabb8dee9be2cdcd6d3f9a125572ec0454"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"url":"https://git.kernel.org/stable/c/18a693733f7ad004e1ab0466693121ca70cd95dd"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"url":"https://git.kernel.org/stable/c/1dd9cb98fe228e017fff9efb33862ff38c741b65"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"url":"https://git.kernel.org/stable/c/311011f8cc206c5af2877b03e3f627ee1b8fe024"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"url":"https://git.kernel.org/stable/c/45ca1afe2fd14c04e37227e79d3f8455831d8408"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"url":"https://git.kernel.org/stable/c/52dc40ef0cfee6ae89b7524967e73f0ba37906d7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"url":"https://git.kernel.org/stable/c/6883269a323609f68f6faa903f8f8ff3d191cec8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"url":"https://git.kernel.org/stable/c/6df926130aee6cab9b5d2e5b7862e49ccac348dc"}],"remediation":[],"revision":"55555b607b608010f3fd153f48f7631a726dde7a59f9f8e75174d56c210de693","sources":[{"modifiedAt":1793984120776,"name":"CNA: Linux","retrievedAt":1793986050498,"url":"https://www.cve.org/CVERecord?id=CVE-2026-72138"},{"modifiedAt":1793985577850,"name":"NVD","retrievedAt":1793989688739,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72138"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793986078817,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-72138"}],"ssvc":{"assessedAt":1793983914267,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"xen/gntdev: fix error handling in ioctl","updatedAt":1793989688739}