CVE-2026-72138

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

xen/gntdev: fix error handling in ioctl

When gntdev_ioctl_map_grant_ref() fails to copy the operation result

back to userspace after successfully adding the mapping to the list,

the error path returns -EFAULT without releasing the reference

acquired by gntdev_alloc_map(). The mapping remains in priv->maps

with a refcount of 1, causing a memory leak and a dangling list

entry.

Additionally, gntdev_add_map() may modify map->index to avoid overlap

with existing mappings. Therefore, the index returned to userspace

must be obtained after gntdev_add_map() completes.

Fix this by holding the mutex across gntdev_add_map(), retrieving

the correct index, and copy_to_user(). If copy_to_user() fails,

remove the mapping from the list and release the reference while

still holding the lock.

Fix these issues by properly handling all error cases.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References