CVE-2026-72482

CVE-2026-72482 is a double-decrement bug in the gpib kernel driver's command_ioctl() handler. The original security fix (commit d1857f8296dc) introduced descriptor_busy as a reference pin to prevent use-after-free during concurrent ioctl operations — increment before the operation, decrement after. The problem: command_ioctl() contains a loop where the error path breaks and decrements inside the loop, then falls through to a second, unconditional decrement after the loop exits. This produces descriptor_busy = -1, allowing close_dev_ioctl() to race past the gate on a still-referenced descriptor, triggering the original use-after-free the fix was meant to prevent. Read_ioctl() and write_ioctl() implement this pattern correctly. command_ioctl() was patched mechanically without accounting for its loop structure — the original fix assumed uniform control flow across handlers. What to check: If you maintain any ioctl handlers using reference-gating (descriptor_busy, file->f_count, or similar patterns), audit every exit path. The invariant is strict: exactly one decrement per handler entry, regardless of whether the path exits early from a loop, nested conditional, or error break. Document this invariant explicitly above every gating site — static analysis can catch double-decrements syntactically, but it cannot infer the missing-decrement case without knowing the intended contract. The blast radius matters more than the niche subsystem suggests. Once descriptor_busy underflows, the resulting use-after-free corrupts kernel heap state — privilege escalation is the realistic failure mode, not just a driver crash. Prioritize patching regardless of gpib's peripheral status in your environment.

Reviewed through automated stages and approved by a human before publication.