CVE-2026-23380

tracing: Fix WARN_ON in tracing_buffers_mmap_close

published March 25, 2026

CVSS
—
EPSS
0%
Percentile
1.6
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

tracing: Fix WARN_ON in tracing_buffers_mmap_close

When a process forks, the child process copies the parent's VMAs but the

user_mapped reference count is not incremented. As a result, when both the

parent and child processes exit, tracing_buffers_mmap_close() is called

twice. On the second call, user_mapped is already 0, causing the function to

return -ENODEV and triggering a WARN_ON.

Normally, this isn't an issue as the memory is mapped with VM_DONTCOPY set.

But this is only a hint, and the application can call

madvise(MADVISE_DOFORK) which resets the VM_DONTCOPY flag. When the

application does that, it can trigger this issue on fork.

Fix it by incrementing the user_mapped reference count without re-mapping

the pages in the VMA's open callback.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00118 · 1.6th percentile
Published
2026-03-25T10:27Z
EPSS history
Timeline
  • 25 MAR 10:27Z
    tracing: Fix WARN_ON in tracing_buffers_mmap_close
    cvelistv5