Executive brief
A vulnerability in the Linux kernel's process information system (procfs) could allow a local user to crash the system or potentially gain elevated privileges. The issue occurs when the system handles specific memory mapping queries with incorrectly sized data buffers, leading to a double-release of internal memory resources. This could result in a system-wide denial of service or unauthorized access to sensitive data.
Technical details
A double mmput() vulnerability exists in the do_procmap_query() function within fs/proc/task_mmu.c of the Linux kernel. The flaw is triggered when a user provides an incorrectly sized buffer for a build ID during a PROCMAP_QUERY request. Due to recent logic changes, an error condition (-ENAMETOOLONG) is encountered after the mmap_lock has been released and mmput() has already been called. The subsequent error handling path incorrectly executes a second mmput() on the mm_struct. This local attack vector requires no special privileges beyond the ability to query process maps. Patches have been released for various stable kernel branches including 6.12.y, 6.18.y, and 6.19.y.
Affected products
- Linux Linux Kernel 6.12.70 to 6.12.75, 6.18.10 to 6.18.16, 6.19 to 6.19.6
Timeline
- 2026-02-10: other: Vulnerability fixed in upstream source code
- 2026-05-06: disclosed: CVE published
References
- https://git.kernel.org/stable/c/61dc9f776705d6db6847c101b98fa4f0e9eb6fa3
- https://git.kernel.org/stable/c/8adaff87db143583e08eec4f4e7788f1ef8af94d
- https://git.kernel.org/stable/c/90f5e87c9b75833b9ef3a4415b92c0247f28ab2f
- https://git.kernel.org/stable/c/f9fe092084cd04deea18747f58a2304026e76aaa
- https://access.redhat.com/security/cve/CVE-2026-43178
- https://bugzilla.redhat.com/show_bug.cgi?id=2467227
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43178.json