CVE-2026-23380: Linux

Описание

Оригинално описание

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix WARN_ON in tracing_buffers_mmap_close When a process forks, the child process copies the parent's VMAs but the user_mapped reference count is not incremented. As a result, when both the parent and child processes exit, tracing_buffers_mmap_close() is called twice. On the second call, user_mapped is already 0, causing the function to return -ENODEV and triggering a WARN_ON. Normally, this isn't an issue as the memory is mapped with VM_DONTCOPY set. But this is only a hint, and the application can call madvise(MADVISE_DOFORK) which resets the VM_DONTCOPY flag. When the application does that, it can trigger this issue on fork. Fix it by incrementing the user_mapped reference count without re-mapping the pages in the VMA's open callback.

Засегнати продукти

• Linux Linux: cf9f0f7c4c5bb45e7bb270e48bab6f7837825a64 преди 91f3e8d84c89918769e71393f839c9fefadc2580; cf9f0f7c4c5bb45e7bb270e48bab6f7837825a64 преди cdd96641b64297a2db42676f051362b76280a58b; cf9f0f7c4c5bb45e7bb270e48bab6f7837825a64 преди b0f269ba6fefe9e3cb9feedcf78fcd0b633800c0; cf9f0f7c4c5bb45e7bb270e48bab6f7837825a64 преди e39bb9e02b68942f8e9359d2a3efe7d37ae6be0e
• Linux Linux: 6.10; преди 6.10; 6.12.77 до 6.12.*; 6.18.17 до 6.18.*; 6.19.7 до 6.19.*; от 7.0 нататък

История

Други уязвимости в Linux Linux

• 8.1CVE-2026-99270
• 7.8CVE-2026-99269
• CVE-2026-99268
• CVE-2026-99266
• CVE-2026-99267

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-23380
• https://nvd.nist.gov/vuln/detail/CVE-2026-23380
• https://git.kernel.org/stable/c/91f3e8d84c89918769e71393f839c9fefadc2580
• https://git.kernel.org/stable/c/cdd96641b64297a2db42676f051362b76280a58b
• https://git.kernel.org/stable/c/b0f269ba6fefe9e3cb9feedcf78fcd0b633800c0
• https://git.kernel.org/stable/c/e39bb9e02b68942f8e9359d2a3efe7d37ae6be0e