In the Linux kernel, the following vulnerability has been resolved:
xen/gntdev: fix error handling in ioctl
When gntdev_ioctl_map_grant_ref() fails to copy the operation result back to userspace after successfully adding the mapping to the list, the error path returns -EFAULT without releasing the reference acquired by gntdev_alloc_map(). The mapping remains in priv->maps with a refcount of 1, causing a memory leak and a dangling list entry.
Additionally, gntdev_add_map() may modify map->index to avoid overlap with existing mappings. Therefore, the index returned to userspace must be obtained after gntdev_add_map() completes.
Fix this by holding the mutex across gntdev_add_map(), retrieving the correct index, and copy_to_user(). If copy_to_user() fails, remove the mapping from the list and release the reference while still holding the lock.
Fix these issues by properly handling all error cases.
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade kernel-tools-debuginfoUpgrade python3-perf-debuginfoUpgrade perfUpgrade kernel-develUpgrade kernel-tools-develUpgrade python3-perfUpgrade kernel-modules-extraUpgrade perf-debuginfoUpgrade kernel-headersUpgrade kernel-debuginfoUpgrade kernelUpgrade kernel-livepatch-6.1.180-225.360Upgrade kernel-modules-extra-commonUpgrade kernel-debuginfo-common-aarch64Upgrade bpftool-debuginfoUpgrade bpftoolUpgrade kernel-toolsUpgrade kernel-debuginfo-common-x86_64 | Sep 1, 2026 | Aug 15, 2026 |
| Debian | — | Upgrade linux | Aug 16, 2026 | Aug 16, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Aug 25, 2026 | Aug 15, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub