CVE-2026-72482 (GCVE-0-2026-72482)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:57 – Updated: 2026-08-17 05:44
VLAI
Title
gpib: fix double decrement of descriptor_busy in command_ioctl()
Summary
In the Linux kernel, the following vulnerability has been resolved: gpib: fix double decrement of descriptor_busy in command_ioctl() commit d1857f8296dc ("gpib: fix use-after-free in IO ioctl handlers") introduced a descriptor_busy reference counter to pin struct gpib_descriptor across IO ioctl operations. In command_ioctl(), the error path inside the loop decrements descriptor_busy and breaks, but execution then falls through to the unconditional decrement after the loop, underflowing the counter to -1. This re-enables the use-after-free that the original fix was meant to prevent: a concurrent close_dev_ioctl() sees descriptor_busy == 0 on an actively-used descriptor and frees it. Remove the early decrement from the error path. The post-loop decrement already handles all exit paths, matching the correct pattern used in read_ioctl() and write_ioctl().
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: cae26eff1b56d78bed7873cf3e60a2b1bdd4da6c , < fdee9f207a48ce204ec6cfceaa1459d2473600a5 (git)
Affected: d1857f8296dceb75d00ab857fc3c61bc00c7f5c6 , < 8b5f1d295dda8677e4545ce340053fcfa8b634c7 (git)
Affected: d1857f8296dceb75d00ab857fc3c61bc00c7f5c6 , < c4faab452b3c1ada003d49c477609dd80523b9bf (git)
Affected: 28c75dd143ead62e0dfac564c79d251e21d5d74b (git)
Affected: 6.18.22 , < 6.18.40 (semver)
Affected: 6.19.12 , < 6.20 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 7.0
Unaffected: 0 , < 7.0 (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpib/common/gpib_os.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "fdee9f207a48ce204ec6cfceaa1459d2473600a5",
              "status": "affected",
              "version": "cae26eff1b56d78bed7873cf3e60a2b1bdd4da6c",
              "versionType": "git"
            },
            {
              "lessThan": "8b5f1d295dda8677e4545ce340053fcfa8b634c7",
              "status": "affected",
              "version": "d1857f8296dceb75d00ab857fc3c61bc00c7f5c6",
              "versionType": "git"
            },
            {
              "lessThan": "c4faab452b3c1ada003d49c477609dd80523b9bf",
              "status": "affected",
              "version": "d1857f8296dceb75d00ab857fc3c61bc00c7f5c6",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "28c75dd143ead62e0dfac564c79d251e21d5d74b",
              "versionType": "git"
            },
            {
              "lessThan": "6.18.40",
              "status": "affected",
              "version": "6.18.22",
              "versionType": "semver"
            },
            {
              "lessThan": "6.20",
              "status": "affected",
              "version": "6.19.12",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpib/common/gpib_os.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.0"
            },
            {
              "lessThan": "7.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "6.18.22",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "7.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "7.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.19.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngpib: fix double decrement of descriptor_busy in command_ioctl()\n\ncommit d1857f8296dc (\"gpib: fix use-after-free in IO ioctl handlers\")\nintroduced a descriptor_busy reference counter to pin struct\ngpib_descriptor across IO ioctl operations.  In command_ioctl(), the\nerror path inside the loop decrements descriptor_busy and breaks, but\nexecution then falls through to the unconditional decrement after the\nloop, underflowing the counter to -1.\n\nThis re-enables the use-after-free that the original fix was meant to\nprevent: a concurrent close_dev_ioctl() sees descriptor_busy == 0 on\nan actively-used descriptor and frees it.\n\nRemove the early decrement from the error path.  The post-loop\ndecrement already handles all exit paths, matching the correct pattern\nused in read_ioctl() and write_ioctl()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only through local ioctl on /dev/gpibN character devices; exploitation requires concurrent IBCMD (command_ioctl) and IBCLOSEDEV calls, not remote network traffic or physical GPIB bus manipulation.\nAC:L - Once a GPIB board is online and accessible, an attacker controls both race participants by running a failing IBCMD ioctl in one thread and IBCLOSEDEV on the same handle in another; ibcmd errors (e.g., timeout or missing CIC) are reliably triggerable.\nPR:L - The vulnerable IBCMD and IBCLOSEDEV ioctls perform no capability checks; any local user with access to an already-configured, online GPIB device node can open handles and race command/close operations typical of lab and factory test automation accounts.\nUI:N - No victim interaction is required beyond the attacker already having local access to the GPIB device; exploitation is performed entirely through attacker-controlled ioctl sequences without needing another user to mount, open, or approve actions.\nS:U - This is a kernel heap use-after-free within the GPIB driver reachable from local process ioctls and affects the same kernel security authority; it does not cross virtualization, IOMMU, or separate security-scope boundaries.\nC:H - The erroneous early descriptor_busy decrement lets close_dev_ioctl kfree() the struct while command_ioctl still holds and dereferences it; freed kmalloc slab reuse can expose or help derive kernel memory contents per UAF scoring guidance.\nI:H - Post-free atomic writes to io_in_progress and descriptor_busy on the stale pointer can corrupt attacker-influenced reused heap objects, providing a plausible path to kernel data corruption, write primitives, or privilege escalation.\nA:H - Dereferencing the freed gpib_descriptor during IBCMD completion (atomic_set, atomic_dec, wake_up) can cause kernel oops, BUG, or panic; use-after-free bugs are scored as high availability impact even before full exploitation."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:44:45.643Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/fdee9f207a48ce204ec6cfceaa1459d2473600a5"
        },
        {
          "url": "https://git.kernel.org/stable/c/8b5f1d295dda8677e4545ce340053fcfa8b634c7"
        },
        {
          "url": "https://git.kernel.org/stable/c/c4faab452b3c1ada003d49c477609dd80523b9bf"
        }
      ],
      "title": "gpib: fix double decrement of descriptor_busy in command_ioctl()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72482",
    "datePublished": "2026-08-15T05:57:20.247Z",
    "dateReserved": "2026-08-09T03:40:39.935Z",
    "dateUpdated": "2026-08-17T05:44:45.643Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-72482",
      "date": "2026-09-21",
      "epss": "0.0013",
      "percentile": "0.03017"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/gpib/common/gpib_os.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "fdee9f207a48ce204ec6cfceaa1459d2473600a5",
                    "status": "affected",
                    "version": "cae26eff1b56d78bed7873cf3e60a2b1bdd4da6c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "8b5f1d295dda8677e4545ce340053fcfa8b634c7",
                    "status": "affected",
                    "version": "d1857f8296dceb75d00ab857fc3c61bc00c7f5c6",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "c4faab452b3c1ada003d49c477609dd80523b9bf",
                    "status": "affected",
                    "version": "d1857f8296dceb75d00ab857fc3c61bc00c7f5c6",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "28c75dd143ead62e0dfac564c79d251e21d5d74b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6.18.40",
                    "status": "affected",
                    "version": "6.18.22",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.20",
                    "status": "affected",
                    "version": "6.19.12",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/gpib/common/gpib_os.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "7.0"
                  },
                  {
                    "lessThan": "7.0",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.40",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngpib: fix double decrement of descriptor_busy in command_ioctl()\n\ncommit d1857f8296dc (\"gpib: fix use-after-free in IO ioctl handlers\")\nintroduced a descriptor_busy reference counter to pin struct\ngpib_descriptor across IO ioctl operations.  In command_ioctl(), the\nerror path inside the loop decrements descriptor_busy and breaks, but\nexecution then falls through to the unconditional decrement after the\nloop, underflowing the counter to -1.\n\nThis re-enables the use-after-free that the original fix was meant to\nprevent: a concurrent close_dev_ioctl() sees descriptor_busy == 0 on\nan actively-used descriptor and frees it.\n\nRemove the early decrement from the error path.  The post-loop\ndecrement already handles all exit paths, matching the correct pattern\nused in read_ioctl() and write_ioctl()."
          }
        ],
        "id": "CVE-2026-72482",
        "lastModified": "2026-08-17T06:19:16.347",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-15T06:22:22.430",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/8b5f1d295dda8677e4545ce340053fcfa8b634c7"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/c4faab452b3c1ada003d49c477609dd80523b9bf"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/fdee9f207a48ce204ec6cfceaa1459d2473600a5"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-01T10:36:42+00:00",
      "cve": "CVE-2026-72482",
      "id": "CVE-2026-72482",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: gpib: fix double decrement of descriptor_busy in command_ioctl()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72482.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.