Executive brief
A security vulnerability exists in the Linux kernel's memory management system. This flaw could allow a local user to cause a system crash or potentially execute unauthorized code by exploiting a race condition when the system reuses memory structures. This affects the stability and security of the operating system, potentially leading to a full system compromise.
Technical details
A use-after-free (UAF) vulnerability exists in the Linux kernel's memory management subsystem due to a race condition in lock_vma_under_rcu(). The issue was introduced when VMAs were allowed to be recycled using SLAB_TYPESAFE_BY_RCU. When lock_vma_under_rcu() performs a lockless lookup, a VMA may be concurrently freed and recycled by another process. If vma_start_read() succeeds on a recycled VMA, a subsequent mismatch detection in lock_vma_under_rcu() triggers vma_refcount_put(), which may attempt to access a freed mm_struct via rcuwait_wake_up(). This occurs because the code incorrectly assumes the caller maintains the stability of the VMA's associated mm_struct. The fix involves moving the vm_mm verification into vma_start_read() and using mmgrab() to stabilize the pointer before releasing the VMA reference.
Affected products
- Linux Linux Kernel 6.15 to 6.15.10, 6.16 to 6.16.1
Timeline
- 2025-08-19: disclosed: CVE published
- 2025-08-15: patched: Fixes committed to stable branches