CVE-2026-72482
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
In the Linux kernel, the gpib driver has a double decrement of the descriptor_busy counter in command_ioctl(). The error path inside the loop decrements the counter and breaks, but then an unconditional decrement after the loop occurs, causing an underflow. This re-enables the use-after-free that the original fix intended to prevent. The fix removes the early decrement from the error path.
Risk Assessment
The vulnerability can lead to use-after-free, potentially resulting in system crash or arbitrary code execution in kernel context. It requires local access and the ability to trigger IOCTL operations.
Recommendation
Apply the patch from the Linux kernel that removes the early decrement. Update the kernel to a patched version.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: gpib: fix double decrement of descriptor_busy in command_ioctl() commit d1857f8296dc ("gpib: fix use-after-free in IO ioctl handlers") introduced a descriptor_busy reference counter to pin struct gpib_descriptor across IO ioctl operations. In command_ioctl(), the error path inside the loop decrements descriptor_busy and breaks, but execution then falls through to the unconditional decrement after the loop, underflowing the counter to -1. This re-enables the use-after-free that the original fix was meant to prevent: a concurrent close_dev_ioctl() sees descriptor_busy == 0 on an actively-used descriptor and frees it. Remove the early decrement from the error path. The post-loop decrement already handles all exit paths, matching the correct pattern used in read_ioctl() and write_ioctl().