Double mmput in Linux Kernel procfs

Publication date: 2026-05-06

Last updated on: 2026-06-30

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: procfs: fix possible double mmput() in do_procmap_query() When user provides incorrectly sized buffer for build ID for PROCMAP_QUERY we return with -ENAMETOOLONG error. After recent changes this condition happens later, after we unlocked mmap_lock/per-VMA lock and did mmput(), so original goto out is now wrong and will double-mmput() mm_struct. Fix by jumping further to clean up only vm_file and name_buf.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-05-06

Last Modified

2026-06-30

Generated

2026-07-06

AI Q&A

2026-05-06

EPSS Evaluated

2026-07-05

NVD

CVE-2026-43178

EUVD

EUVD-2026-27738

Affected Vendors & Products

Vendor	Product	Version / Range
linux_kernel	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1341	The product attempts to close or release a resource or handle more than once, without any successful open between the close operations.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Linux kernel's procfs subsystem, specifically in the function do_procmap_query(). When a user provides an incorrectly sized buffer for the build ID during a PROCMAP_QUERY, the system returns an -ENAMETOOLONG error. However, due to recent changes, this error occurs after unlocking certain locks and performing a memory management put operation (mmput()). The original error handling code then mistakenly performs a second mmput() on the same memory structure, causing a double mmput() issue. The fix involves adjusting the error handling to clean up only specific resources to avoid this double mmput().

Impact Analysis

The vulnerability can lead to a double mmput() call on a memory management structure, which may cause memory corruption or instability in the Linux kernel. This could potentially result in system crashes or unpredictable behavior, impacting system reliability and security.

Hi! I’m here to help you understand CVE-2026-43178. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70