CVE-2026-53373

mm/vma: do not try to unmap a VMA if mmap_prepare() invoked from mmap()

High · published July 19, 2026

CVSS v3.1
7.8
EPSS
0%
Percentile
5.4
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

mm/vma: do not try to unmap a VMA if mmap_prepare() invoked from mmap()

The mmap_prepare hook functionality includes the ability to invoke

mmap_prepare() from the mmap() hook of existing 'stacked' drivers, that is

ones which are capable of calling the mmap hooks of other drivers/file

systems (e.g. overlayfs, shm).

As part of the mmap_prepare action functionality, we deal with errors by

unmapping the VMA should one arise. This works in the usual mmap_prepare

case, as we invoke this action at the last moment, when the VMA is

established in the maple tree.

However, the mmap() hook passes a not-fully-established VMA pointer to the

caller (which is the motivation behind the mmap_prepare() work), which is

detached.

So attempting to unmap a VMA in this state will be problematic, with the

most obvious symptom being a warning in vma_mark_detached(), because the

VMA is already detached.

It's also unncessary - the mmap() handler will clean up the VMA on error.

So to fix this issue, this patch propagates whether or not an mmap action

is being completed via the compatibility layer or directly.

If the former, then we do not attempt VMA cleanup, if the latter, then we

do.

This patch also updates the userland VMA tests to reflect the change.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00165 · 5.4th percentile
Published
2026-07-19T10:01Z
EPSS history
Timeline
  • 19 JUL 10:01Z
    mm/vma: do not try to unmap a VMA if mmap_prepare() invoked from mmap()
    cvelistv5