linux-cve-announce - CVE-2026-23056: uacce: implement mremap in uacce_vm

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2026020413-CVE-2026-23056-ddc8@gregkh>
Date: Wed,  4 Feb 2026 17:14:15 +0100
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2026-23056: uacce: implement mremap in uacce_vm_ops to return -EPERM

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

uacce: implement mremap in uacce_vm_ops to return -EPERM

The current uacce_vm_ops does not support the mremap operation of
vm_operations_struct. Implement .mremap to return -EPERM to remind
users.

The reason we need to explicitly disable mremap is that when the
driver does not implement .mremap, it uses the default mremap
method. This could lead to a risk scenario:

An application might first mmap address p1, then mremap to p2,
followed by munmap(p1), and finally munmap(p2). Since the default
mremap copies the original vma's vm_private_data (i.e., q) to the
new vma, both munmap operations would trigger vma_close, causing
q->qfr to be freed twice(qfr will be set to null here, so repeated
release is ok).

The Linux kernel CVE team has assigned CVE-2026-23056 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.7 with commit 015d239ac0142ad0e26567fd890ef8d171f13709 and fixed in 6.6.122 with commit 4c042bc71474dbe417c268f4bfb8ec196f802f07
	Issue introduced in 5.7 with commit 015d239ac0142ad0e26567fd890ef8d171f13709 and fixed in 6.12.68 with commit a407ddd61b3e6afc5ccfcd1478797171cf5686ee
	Issue introduced in 5.7 with commit 015d239ac0142ad0e26567fd890ef8d171f13709 and fixed in 6.18.8 with commit ba29b59d124e725e0377f09b2044909c91d657a1
	Issue introduced in 5.7 with commit 015d239ac0142ad0e26567fd890ef8d171f13709 and fixed in 6.19-rc7 with commit 02695347be532b628f22488300d40c4eba48b9b7

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-23056
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/misc/uacce/uacce.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/4c042bc71474dbe417c268f4bfb8ec196f802f07
	https://git.kernel.org/stable/c/a407ddd61b3e6afc5ccfcd1478797171cf5686ee
	https://git.kernel.org/stable/c/ba29b59d124e725e0377f09b2044909c91d657a1
	https://git.kernel.org/stable/c/02695347be532b628f22488300d40c4eba48b9b7