PT-2026-43671 · Linux · Linux Kernel

Published 2026-05-27 · Updated 2026-06-04 · CVE-2026-45837

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the arena vm close function during a fork operation. The arena vm open() function increments the vml->mmap count but fails to register the child Virtual Memory Area (VMA) in the arena->vma list. Consequently, the vml->vma continues to point to the parent VMA. If the parent performs a munmap, the pointer becomes dangling. A subsequent call to bpf arena free pages() by the child causes zap pages() to read the stale vml->vma, leading to a use-after-free condition.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2026-45837

OPENSUSE-SU-2026:10954-1

Affected Products

Linux Kernel

References · 291

• https://osv.dev/vulnerability/openSUSE-SU-2026:10954-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-45837 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-45837 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-45837 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-45837 · Security Note
• https://osv.dev/vulnerability/BELL-CVE-2026-45837 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-45837 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-45837 · Vendor Advisory
• https://suse.com/security/cve/CVE-2026-46149 · Note
• https://suse.com/security/cve/CVE-2026-46187 · Note
• https://suse.com/security/cve/CVE-2026-46037 · Note
• https://suse.com/security/cve/CVE-2026-46158 · Note
• https://suse.com/security/cve/CVE-2026-46204 · Note
• https://suse.com/security/cve/CVE-2026-45995 · Note
• https://suse.com/security/cve/CVE-2026-46242 · Note