High 8.8Published Aug 15, 2026

CVE-2026-74313vduse: hold vduse_lock across IDR lookup in open path

Updated under an hour ago (Oct 28, 2026, 11:50 AM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: vduse: hold vduse_lock across IDR lookup in open path vduse_dev_open() looks up struct vduse_dev through the IDR and then acquires dev->lock only after vduse_lock has been dropped. This leaves a window where a concurrent VDUSE_DESTROY_DEV can remove the same object from the IDR and free it before the open path locks the device, leading to a use-after-free. Close this race by keeping vduse_lock held until dev->lock has been acquired in the open path, matching the lock ordering already used by the destroy path.

CVSS: 8.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Oct 16, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from c8a6153b6c59d95c0e091f053f6f180952ade91e before 35483c5306e09b3190ff937089d404a78012695c; from c8a6153b6c59d95c0e091f053f6f180952ade91e before 5c1560be8aa6849356455af67518d35c551cbd95; from c8a6153b6c59d95c0e091f053f6f180952ade91e before 93ed4692f2299a40346025979f40e4a9b7b33af7; from c8a6153b6c59d95c0e091f053f6f180952ade91e before d94e2947203aead590fd63f667d316d4475d65af; from c8a6153b6c59d95c0e091f053f6f180952ade91e before a2d0a57538fd0b3b3ab75d64bb64f4cd2fab13a2; from c8a6153b6c59d95c0e091f053f6f180952ade91e before 79e12c891940b0c4c75881b7fd82a8cbb8ac97be; from c8a6153b6c59d95c0e091f053f6f180952ade91e before e440e077748939839d9f76e24383b76b785f80ce	CNA record

References

References

https://git.kernel.org/stable/c/35483c5306e09b3190ff937089d404a78012695c
https://git.kernel.org/stable/c/5c1560be8aa6849356455af67518d35c551cbd95
https://git.kernel.org/stable/c/93ed4692f2299a40346025979f40e4a9b7b33af7
https://git.kernel.org/stable/c/d94e2947203aead590fd63f667d316d4475d65af
https://git.kernel.org/stable/c/a2d0a57538fd0b3b3ab75d64bb64f4cd2fab13a2
https://git.kernel.org/stable/c/79e12c891940b0c4c75881b7fd82a8cbb8ac97be
https://git.kernel.org/stable/c/e440e077748939839d9f76e24383b76b785f80ce

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.