PT-2026-6147 · Linux · Linux Kernel

Syzbot · Published 2026-01-01 · Updated 2026-02-04 · CVE-2026-23077

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The Linux kernel contains a use-after-free issue within the mm/vma subsystem, specifically related to merging Virtual Memory Areas (VMAs) after a memory remapping operation (mremap). The problem arises when merging a faulted VMA adjacent to an unfaulted VMA. The issue occurs in scenarios where the previous VMA is unfaulted, the next VMA is unfaulted, or both adjacent VMAs are unfaulted. The root cause is an incorrect handling of anonymous VMA state during the merge process, particularly when a new VMA is merged using mremap. The vulnerability was discovered through a syzbot report and addressed by ensuring that the dup anon vma() function is correctly invoked to handle anonymous VMA state in all relevant cases. The fix also includes cleanup of the vma expand() function and renaming of vma had uncowed parents() to vma is fork child() for clarity.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2026-23077

Affected Products

Linux Kernel

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23077.json · Exploit
• https://cve.org/CVERecord?id=CVE-2026-23077 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-23077 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-23077 · Vendor Advisory
• https://git.kernel.org/stable/c/a4d9dbfc1bab16e25fefd34b5e537a46bed8fc96 · Patch
• https://git.kernel.org/stable/c/61f67c230a5e7c741c352349ea80147fbe65bfae · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-23077 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23077 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-23077 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-23077 · Vendor Advisory
• https://git.kernel.org/linus/61f67c230a5e7c741c352349ea80147fbe65bfae · Note
• https://twitter.com/vuldb/status/2019093145880035395 · Twitter Post
• https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git · Note