CVE-2026-74354

Status: UPDATED  |  Advisory ID: CVE-2026-74354

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

bpf: Take mmap_lock in zap_pages()

zap_vma_range() requires the owning mm's mmap_lock to be held.

Taking mmap_read_lock under arena->lock would AB-BA against

arena_vm_close() and arena_map_mmap(), both of which run with

mmap_write_lock held and then acquire arena->lock. Instead drop

arena->lock, mmget_not_zero() the vma's mm, take mmap_read_lock, and

re-resolve the vma via find_vma() since it may have been unmapped or

replaced while waiting.

Track processed vmls with a per-call generation in vml->zap_gen and

serialize zap_pages() callers with a new arena->zap_mutex so

concurrent callers on different uaddr ranges do not mark each other's

vmls processed before the zap is done. (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References