CVE-2026-98224

Received Received - Intake

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: mm/vma: correctly unaccount on mmap_prepare() failure __mmap_setup() accounts memory for relevant mappings via: security_vm_enough_memory_mm() -> __vm_enough_memory() -> vm_acct_memory() If __mmap_setup() fails, this indicates that this accounting did not take place, and thus it's appropriate for __mmap_region() to jump to abort_munmap. However if call_mmap_prepare() fails, it also jumps there and any accounted memory is not correctly unaccounted. Fix this by handling each error separately.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-06

EPSS Evaluated

2026-10-18

NVD

CVE-2026-98224

EUVD

EUVD-2026-93152

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	c84bf6dd2b836b49bb2662668ff1692350d28236
Linux	Linux	c84bf6dd2b836b49bb2662668ff1692350d28236
Linux	Linux	c84bf6dd2b836b49bb2662668ff1692350d28236
Linux	Linux	6.16

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves incorrect memory accounting when a memory mapping setup fails. Normally, memory is accounted for during setup, but if the setup fails, the system does not properly reverse the accounting. This can lead to memory being incorrectly tracked as allocated.

Detection Guidance

This vulnerability is specific to the Linux kernel's memory management. Detection requires checking kernel logs for mmap-related errors or failures during memory accounting. Use commands like 'dmesg | grep -i mmap' or 'journalctl -k | grep -i mmap' to inspect kernel logs for relevant errors.

Impact Analysis

This vulnerability could cause the system to incorrectly report or manage memory resources. It may lead to memory leaks or crashes if the system runs out of memory unexpectedly due to improper accounting.

Compliance Impact

This vulnerability involves incorrect memory accounting in the Linux kernel during mmap operations, which could lead to resource leaks or improper memory management. While it does not directly impact GDPR or HIPAA compliance, such low-level memory issues may indirectly affect system stability and data integrity, potentially compromising secure data handling required by these regulations.

Mitigation Strategies

Update your Linux kernel to the latest patched version. Monitor kernel logs for mmap failures or memory accounting issues. If you cannot update immediately, restrict access to untrusted users to reduce exposure.

Hi! I’m here to help you understand CVE-2026-98224. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70