CVE-2026-72282

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A lifetime issue exists in the KVM component where the kvm io bus get dev() function returns a device matched only by address. If the matched device is not of the expected type, the object may be deleted before the caller can introspect it because the SRCU (Sleep-Read-Copy-Update) lock is dropped too early.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.