CVE-2026-45837: In the Linux kernel, the following vulnerability has been resolved: bpf: Fix use-after-free in arena_vm_close on fork arena_vm_open() only bumps…

high7

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix use-after-free in arena_vm_close on fork arena_vm_open() only bumps vml->mmap_count but never registers the child VMA in arena->vma_list. The vml->vma always points at the parent VMA, so after parent munmap the pointer dangles. If the child then calls bpf_arena_free_pages(), zap_pages() reads the stale vml->vma triggering use-after-free. Fix this by preventing the arena VMA from being inherited across fork with VM_DONTCOPY, and preventing VMA splits via the may_split callback. Also reject mremap with a .mremap callback returning -EINVAL. A same-size mremap(MREMAP_FIXED) on the full arena VMA reaches copy_vma() through the following path: check_prep_vma() - returns 0 early: new_len == old_len skips VM_DONTEXPAND check prep_move_vma() - vm_start == old_addr and vm_end == old_addr + old_len so may_split is never called move_vma() copy_vma_and_data() copy_vma() vm_area_dup() - copies vm_private_data (vml pointer) vm_ops->open() - bumps vml->mmap_count vm_ops->mremap() - returns -EINVAL, rollback unmaps new VMA The refcount ensures the rollback's arena_vm_close does not free the vml shared with the original VMA.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
linux	linux	—	—
linux	linux	>= 317460317a02a1af512697e6e964298dedd8a163 < 723b9fa930cc277c15ce6b9ec9feec828cfac9d7	723b9fa930cc277c15ce6b9ec9feec828cfac9d7
linux	linux	>= 317460317a02a1af512697e6e964298dedd8a163 < d18099f19e53250f8ad2801498b88cec29d9107a	d18099f19e53250f8ad2801498b88cec29d9107a
linux	linux	>= 317460317a02a1af512697e6e964298dedd8a163 < 201128fcc7b213d27ab77bc4e89488b41796480f	201128fcc7b213d27ab77bc4e89488b41796480f
linux	linux	>= 317460317a02a1af512697e6e964298dedd8a163 < 4fddde2a732de60bb97e3307d4eb69ac5f1d2b74	4fddde2a732de60bb97e3307d4eb69ac5f1d2b74
linux	linux_kernel	—	—