CVE-2026-31769

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

gpib: fix use-after-free in IO ioctl handlers

The IBRD, IBWRT, IBCMD, and IBWAIT ioctl handlers use a gpib_descriptor

pointer after board->big_gpib_mutex has been released. A concurrent

IBCLOSEDEV ioctl can free the descriptor via close_dev_ioctl() during

this window, causing a use-after-free.

The IO handlers (read_ioctl, write_ioctl, command_ioctl) explicitly

release big_gpib_mutex before calling their handler. wait_ioctl() is

called with big_gpib_mutex held, but ibwait() releases it internally

when wait_mask is non-zero. In all four cases, the descriptor pointer

obtained from handle_to_descriptor() becomes unprotected.

Fix this by introducing a kernel-only descriptor_busy reference count

in struct gpib_descriptor. Each handler atomically increments

descriptor_busy under file_priv->descriptors_mutex before releasing the

lock, and decrements it when done. close_dev_ioctl() checks

descriptor_busy under the same

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References