CVE-2026-43178

procfs: fix possible double mmput() in do_procmap_query()

HIGH

7.8

CVSS Score

Published: May 6, 2026 at 11:27 AM UTC

Updated: August 5, 2026 at 01:24 PM UTC

1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.8

Exploit prediction

EPSS 0.1%

Description

In the Linux kernel, the following vulnerability has been resolved: procfs: fix possible double mmput() in do_procmap_query() When user provides incorrectly sized buffer for build ID for PROCMAP_QUERY we return with -ENAMETOOLONG error. After recent changes this condition happens later, after we unlocked mmap_lock/per-VMA lock and did mmput(), so original goto out is now wrong and will double-mmput() mm_struct. Fix by jumping further to clean up only vm_file and name_buf.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel · Linux

95%

6.12.70 ≤ v < 6.12.756.18.10 ≤ v < 6.18.166.19 ≤ v < 6.19.66.19 ≤ v < 7.06.19.1 ≤ v < 6.19.66.12.70 6.18.10 6.19b5cbacd7f86f4f62b8813688c8e73be94e8e1951b9b97e6aeb534315f9646b2090d1a5024c6a4e82cbc03ce3e6ce7e21214c3f02218213574c1a2d08

Vendor states this is fixed in 61dc9f776705d6db6847c101b98fa4f0e9eb6fa3 (fixed)

Vendor states this is fixed in 8adaff87db143583e08eec4f4e7788f1ef8af94d (fixed)

Vendor states this is fixed in 90f5e87c9b75833b9ef3a4415b92c0247f28ab2f (fixed)

Vendor states this is fixed in f9fe092084cd04deea18747f58a2304026e76aaa (fixed)

Vendor states this is fixed in 6.12.75 (unaffected)

Vendor states this is fixed in 6.18.16 (unaffected)

Vendor states this is fixed in 6.19 (unaffected)

Vendor states this is fixed in 6.19.6 (unaffected)

Vendor states this is fixed in 7.0 (unaffected)