The vduse driver in the Linux kernel mishandles compatibility ioctl commands. When the kernel receives a VDUSE_IOTLB_GET_FD request, the handler incorrectly calls the native dispatcher after translating the user request. Because the command sizes differ, the native dispatcher returns an error, and the handler overwrites the return value from receive_fd() after a file descriptor has been installed. As a result, one kernel file descriptor is leaked to user space for each ioctl invocation. This flaw directly exposes kernel resources to a non‑privileged process and constitutes an information‑exposure vulnerability.

All Linux kernel releases that have not been updated to include the fix introduced in commit 135ac58097fa5fc707bf392c5cececf59e4080c0 and the related commit 48a4ee65e677559776349128e6a81a6041986c99 are vulnerable. The vduse subsystem is part of the core kernel, so any system exposing the VDUSE ioctl interface remains at risk until the patch is applied.

The vulnerability has a CVSS score of 5.5 and an EPSS score of less than 1 %, and it is not listed in the CISA KEV catalog. Attacks are local; an attacker must have access to a valid VDUSE device node. The flaw causes a kernel file descriptor to be leaked on each vulnerable ioctl call, potentially allowing the attacker to read kernel memory or other protected resources. While the description does not explicitly state that privilege escalation is guaranteed, the leakage of kernel file descriptors could create a foothold for further exploitation. The moderate CVSS score reflects the localized nature of the disclosure, but the exposure of kernel resources remains a significant concern for affected systems.