PT-2026-6126 · Linux+2 · Linux Kernel+2
Published
2026-01-01
·
Updated
2026-05-22
·
CVE-2026-23056
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
The Linux kernel’s user-space accelerated copy engine (uacce) implementation lacks support for the
mremap operation within the vm operations struct. Implementing .mremap to return -EPERM informs users that the operation is not supported. Without this explicit disabling, the default mremap method is used, which can lead to a double-free condition. Specifically, an application could mmap address p1, then mremap to p2, followed by munmap(p1), and finally munmap(p2). The default mremap copies the original vma’s vm private data (represented as q) to the new vma. Consequently, both munmap operations trigger vma close, resulting in the q->qfr being freed twice. The qfr is set to null during the release, mitigating the impact, but still representing a potential issue.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linuxmint
Linux Kernel
Ubuntu