CVE-2026-23077 — mm/vma: fix anon_vma UAF on mremap() faulted, unfaulted merge

Affected: Linux

In the Linux kernel, the following vulnerability has been resolved:

mm/vma: fix anon_vma UAF on mremap() faulted, unfaulted merge

Patch series "mm/vma: fix anon_vma UAF on mremap() faulted, unfaulted merge", v2.

Commit 879bca0a2c4f ("mm/vma: fix incorrectly disallowed anonymous VMA merges") introduced the ability to merge previously unavailable VMA merge scenarios.

However, it is handling merges incorrectly when it comes to mremap() of a faulted VMA adjacent to an unfaulted VMA. The issues arise in three cases:

1. Previous VMA unfaulted:

copied -----| v |-----------|.............| | unfaulted |(faulted VMA)| |-----------|.............| prev

2. Next VMA unfaulted:

copied -----| v |.............|-----------| |(faulted VMA)| unfaulted | |.............|-----------| next

3. Both adjacent VMAs unfaulted:

copied -----| v |-----------|.............|-----------| | unfaulted |(faulted VMA)| unfaulted | |-----------|.............|-----------| prev next

This series fixes each of these cases, and introduces self tests to assert that the issues are corrected.

I also test a further case which was already handled, to assert that my changes continues to correctly handle it:

4. prev unfaulted, next faulted:

copied -----|…

Most recent entries from all

CVE-2026-23077 — mm/vma: fix anon_vma UAF on mremap() faulted, unfaulted merge