Linux EUVD-2026-15372

The vulnerability exists in the Linux kernel's tracing infrastructure, specifically in the tracing_buffers_mmap_close() function which manages memory-mapped access to kernel tracing buffers. When a VMA (Virtual Memory Area) is created for tracing buffers, the VM_DONTCOPY flag is set by default to prevent child processes from inheriting the mapping. However, when an application explicitly calls madvise(MADV_DOFORK), this flag is reset, allowing the child process to copy the parent's VMA. The root cause is a missing reference count increment in the VMA's open callback—when a VMA is copied during fork, the user_mapped counter is not incremented, leading to a mismatch: the parent process decrements the counter on exit, then the child process attempts to decrement an already-zero counter, triggering -ENODEV and a WARN_ON. The affected product is the Linux kernel across all versions (CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*). This is fundamentally a reference counting error (CWE class: improper resource management).