Skip to main content

Linux Kernel CVE-2026-31654

| EUVDEUVD-2026-25547 MEDIUM
Memory Leak (CWE-401)
2026-04-24 Linux GHSA-cg89-59r4-qfhp
Information Disclosure Linux Debian Ubuntu
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
4.7 MEDIUM

Error path triggering requires allocation failure in __mmap_new_vma(), a non-default condition, justifying AC:H over vendor AC:L; no confidentiality or integrity impact applies.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

6
Analysis Generated
Jul 24, 2026 - 02:45 vuln.today
CVSS changed
Apr 27, 2026 - 20:22 NVD
5.5 (MEDIUM)
Patch released
Apr 27, 2026 - 20:16 nvd
Patch available
Patch available
Apr 24, 2026 - 16:16 EUVD
EUVD ID Assigned
Apr 24, 2026 - 15:00 euvd
EUVD-2026-25547
CVE Published
Apr 24, 2026 - 14:45 nvd
MEDIUM 5.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

mm/vma: fix memory leak in __mmap_region()

commit 605f6586ecf7 ("mm/vma: do not leak memory when .mmap_prepare swaps the file") handled the success path by skipping get_file() via file_doesnt_need_get, but missed the error path.

When /dev/zero is mmap'd with MAP_SHARED, mmap_zero_prepare() calls shmem_zero_setup_desc() which allocates a new shmem file to back the mapping. If __mmap_new_vma() subsequently fails, this replacement file is never fput()'d - the original is released by ksys_mmap_pgoff(), but nobody releases the new one.

Add fput() for the swapped file in the error path.

Reproducible with fault injection.

FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 1 CPU: 2 UID: 0 PID: 366 Comm: syz.7.14 Not tainted 7.0.0-rc6 #2 PREEMPT(full) Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x164/0x1f0 should_fail_ex+0x525/0x650 should_failslab+0xdf/0x140 kmem_cache_alloc_noprof+0x78/0x630 vm_area_alloc+0x24/0x160 __mmap_region+0xf6b/0x2660 mmap_region+0x2eb/0x3a0 do_mmap+0xc79/0x1240 vm_mmap_pgoff+0x252/0x4c0 ksys_mmap_pgoff+0xf8/0x120 __x64_sys_mmap+0x12a/0x190 do_syscall_64+0xa9/0x580 entry_SYSCALL_64_after_hwframe+0x76/0x7e </TASK>

kmemleak: 1 new suspected memory leaks (see /sys/kernel/debug/kmemleak) BUG: memory leak unreferenced object 0xffff8881118aca80 (size 360): comm "syz.7.14", pid 366, jiffies 4294913255 hex dump (first 32 bytes): 00 00 00 00 ad 4e ad de ff ff ff ff 00 00 00 00 .....N.......... ff ff ff ff ff ff ff ff c0 28 4d ae ff ff ff ff .........(M..... backtrace (crc db0f53bc): kmem_cache_alloc_noprof+0x3ab/0x630 alloc_empty_file+0x5a/0x1e0 alloc_file_pseudo+0x135/0x220 __shmem_file_setup+0x274/0x420 shmem_zero_setup_desc+0x9c/0x170 mmap_zero_prepare+0x123/0x140 __mmap_region+0xdda/0x2660 mmap_region+0x2eb/0x3a0 do_mmap+0xc79/0x1240 vm_mmap_pgoff+0x252/0x4c0 ksys_mmap_pgoff+0xf8/0x120 __x64_sys_mmap+0x12a/0x190 do_syscall_64+0xa9/0x580 entry_SYSCALL_64_after_hwframe+0x76/0x7e

Found by syzkaller.

AnalysisAI

Memory leak in the Linux kernel's __mmap_region() function allows a local low-privileged user to incrementally exhaust kernel slab memory, potentially causing denial of service. Introduced as a regression by commit 605f6586ecf7, the bug leaves a shmem file object unreferenced when mmap() on /dev/zero with MAP_SHARED fails mid-way through VMA setup - the replacement file allocated by shmem_zero_setup_desc() is never released via fput(). No public exploit exists and EPSS sits at 0.02%, making this a low-urgency but genuine availability risk for affected kernel versions; patched upstream in stable commits 61fc8eaf and 894f99eb.

Technical ContextAI

The vulnerability lies in mm/vma.c within the Linux kernel's virtual memory area subsystem. When /dev/zero is mmap'd with MAP_SHARED, the kernel calls mmap_zero_prepare(), which delegates to shmem_zero_setup_desc() to allocate a new anonymous shmem-backed file (via alloc_file_pseudo -> __shmem_file_setup -> alloc_empty_file). Commit 605f6586ecf7 optimized the success path by introducing file_doesnt_need_get to skip a redundant get_file() call, but left the error path incomplete: if __mmap_new_vma() subsequently fails (e.g., due to vm_area_alloc() returning NULL under slab allocation pressure), the swapped-in shmem file object is never decremented via fput(), leaking 360 bytes per failed mmap call. The root cause class is CWE-401 (Missing Release of Memory After Effective Lifetime) - a resource is conditionally allocated but not freed along all code paths. The call trace confirms exploitation through the standard mmap syscall entry point (ksys_mmap_pgoff -> do_mmap -> mmap_region -> __mmap_region), reachable from unprivileged userspace. The bug was discovered by syzkaller using fault injection to force the kmem_cache_alloc_noprof failure at vm_area_alloc.

RemediationAI

Update to a Linux kernel version containing fix commits 61fc8eaf2ab214b32c7bce52597c80cf0ca41ada (https://git.kernel.org/stable/c/61fc8eaf2ab214b32c7bce52597c80cf0ca41ada) or 894f99eb535edc4514f756818f3c4f688ba53a59 (https://git.kernel.org/stable/c/894f99eb535edc4514f756818f3c4f688ba53a59). EUVD data confirms Linux 6.19.13 and the 7.0 release branch contain the patch. For Ubuntu, Debian, Red Hat, and SUSE, monitor respective security advisories for backported kernel packages. As a compensating control where patching is delayed, restricting local shell access to untrusted users eliminates the attack surface entirely, since exploitation requires PR:L access to invoke mmap() against /dev/zero. Enabling kmemleak (CONFIG_DEBUG_KMEMLEAK) on non-production systems can detect active leak accumulation. There is no meaningful network-level mitigation since the vector is entirely local.

Same weakness CWE-401 – Memory Leak

View all
CVE-2020-13934 HIGH
7.5
CVE-2016-4232 HIGH POC
7.5
CVE-2024-25450 HIGH POC
8.8
CVE-2023-33718 HIGH POC
8.8
CVE-2019-6128 HIGH POC
8.8
CVE-2026-67183 HIGH POC
8.7
CVE-2023-34451 HIGH POC
8.2
CVE-2023-41484 HIGH POC
8.1

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2026-31654 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy