{"affected":[{"defaultStatus":"unaffected","product":"Linux","source":"CNA: Linux","vendor":"Linux","versions":[{"lessThan":"41e27a6aca608c9e04f091c29c420d03fafe0313","status":"affected","version":"8c773d53fb7b64267b0f55c1d3517cb8c5e29b3c","versionType":"git"},{"lessThan":"3ae878f262bd1445c8c31511856a99962a05fe16","status":"affected","version":"8c773d53fb7b64267b0f55c1d3517cb8c5e29b3c","versionType":"git"},{"lessThan":"fde25641cbddd0c084e3320d08f755e7e6acfae5","status":"affected","version":"8c773d53fb7b64267b0f55c1d3517cb8c5e29b3c","versionType":"git"},{"lessThan":"5e88c1bc3a41d9a260dd42bae8ad18fd4f35bbe1","status":"affected","version":"8c773d53fb7b64267b0f55c1d3517cb8c5e29b3c","versionType":"git"},{"lessThan":"690fb82c4122f8c2656fa4f842275132771b68b9","status":"affected","version":"8c773d53fb7b64267b0f55c1d3517cb8c5e29b3c","versionType":"git"},{"lessThan":"00335df9da2011e095f846d645cc2e9fd2907659","status":"affected","version":"8c773d53fb7b64267b0f55c1d3517cb8c5e29b3c","versionType":"git"},{"lessThan":"9c1523803445ee0348f62b77793266dd981596e0","status":"affected","version":"8c773d53fb7b64267b0f55c1d3517cb8c5e29b3c","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","source":"CNA: Linux","vendor":"Linux","versions":[{"status":"affected","version":"5.15"},{"lessThan":"5.15","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.217","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.184","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.148","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.101","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.42","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.5","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"cveId":"CVE-2026-72305","cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nVDUSE: avoid leaking information to userspace\n\nThe bounceing is not necessarily page aligned, so current VDUSE can\nleak kernel information through mapping bounce pages to\nuserspace. Allocate bounce pages with __GFP_ZERO to avoid leaking\ninformation to userspace.","epss":{"date":"2026-11-06","percentile":0.11444,"score":0.00211},"exploits":[],"kev":null,"metrics":[],"modifiedAt":1793985582623,"publishedAt":1786773322914,"references":[{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/41e27a6aca608c9e04f091c29c420d03fafe0313"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/3ae878f262bd1445c8c31511856a99962a05fe16"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/fde25641cbddd0c084e3320d08f755e7e6acfae5"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/5e88c1bc3a41d9a260dd42bae8ad18fd4f35bbe1"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/690fb82c4122f8c2656fa4f842275132771b68b9"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/00335df9da2011e095f846d645cc2e9fd2907659"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/9c1523803445ee0348f62b77793266dd981596e0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"url":"https://git.kernel.org/stable/c/00335df9da2011e095f846d645cc2e9fd2907659"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"url":"https://git.kernel.org/stable/c/3ae878f262bd1445c8c31511856a99962a05fe16"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"url":"https://git.kernel.org/stable/c/41e27a6aca608c9e04f091c29c420d03fafe0313"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"url":"https://git.kernel.org/stable/c/5e88c1bc3a41d9a260dd42bae8ad18fd4f35bbe1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"url":"https://git.kernel.org/stable/c/690fb82c4122f8c2656fa4f842275132771b68b9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"url":"https://git.kernel.org/stable/c/9c1523803445ee0348f62b77793266dd981596e0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"url":"https://git.kernel.org/stable/c/fde25641cbddd0c084e3320d08f755e7e6acfae5"}],"remediation":[],"revision":"2e0e1f3f82fcbcafcfc1c19d64ce16ade9a8f04de44bb93aedbea380fe38b439","sources":[{"modifiedAt":1793984125511,"name":"CNA: Linux","retrievedAt":1793986090377,"url":"https://www.cve.org/CVERecord?id=CVE-2026-72305"},{"modifiedAt":1793985582623,"name":"NVD","retrievedAt":1793989707433,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72305"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793986125344,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-72305"}],"ssvc":{"assessedAt":1793984063648,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"VDUSE: avoid leaking information to userspace","updatedAt":1793989707433}