GHSA-CG89-59R4-QFHP
Vulnerability from github – Published: 2026-04-24 15:32 – Updated: 2026-04-24 15:32In the Linux kernel, the following vulnerability has been resolved:
mm/vma: fix memory leak in __mmap_region()
commit 605f6586ecf7 ("mm/vma: do not leak memory when .mmap_prepare swaps the file") handled the success path by skipping get_file() via file_doesnt_need_get, but missed the error path.
When /dev/zero is mmap'd with MAP_SHARED, mmap_zero_prepare() calls shmem_zero_setup_desc() which allocates a new shmem file to back the mapping. If __mmap_new_vma() subsequently fails, this replacement file is never fput()'d - the original is released by ksys_mmap_pgoff(), but nobody releases the new one.
Add fput() for the swapped file in the error path.
Reproducible with fault injection.
FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 1 CPU: 2 UID: 0 PID: 366 Comm: syz.7.14 Not tainted 7.0.0-rc6 #2 PREEMPT(full) Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: dump_stack_lvl+0x164/0x1f0 should_fail_ex+0x525/0x650 should_failslab+0xdf/0x140 kmem_cache_alloc_noprof+0x78/0x630 vm_area_alloc+0x24/0x160 __mmap_region+0xf6b/0x2660 mmap_region+0x2eb/0x3a0 do_mmap+0xc79/0x1240 vm_mmap_pgoff+0x252/0x4c0 ksys_mmap_pgoff+0xf8/0x120 __x64_sys_mmap+0x12a/0x190 do_syscall_64+0xa9/0x580 entry_SYSCALL_64_after_hwframe+0x76/0x7e
kmemleak: 1 new suspected memory leaks (see /sys/kernel/debug/kmemleak) BUG: memory leak unreferenced object 0xffff8881118aca80 (size 360): comm "syz.7.14", pid 366, jiffies 4294913255 hex dump (first 32 bytes): 00 00 00 00 ad 4e ad de ff ff ff ff 00 00 00 00 .....N.......... ff ff ff ff ff ff ff ff c0 28 4d ae ff ff ff ff .........(M..... backtrace (crc db0f53bc): kmem_cache_alloc_noprof+0x3ab/0x630 alloc_empty_file+0x5a/0x1e0 alloc_file_pseudo+0x135/0x220 __shmem_file_setup+0x274/0x420 shmem_zero_setup_desc+0x9c/0x170 mmap_zero_prepare+0x123/0x140 __mmap_region+0xdda/0x2660 mmap_region+0x2eb/0x3a0 do_mmap+0xc79/0x1240 vm_mmap_pgoff+0x252/0x4c0 ksys_mmap_pgoff+0xf8/0x120 __x64_sys_mmap+0x12a/0x190 do_syscall_64+0xa9/0x580 entry_SYSCALL_64_after_hwframe+0x76/0x7e
Found by syzkaller.
{
"affected": [],
"aliases": [
"CVE-2026-31654"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-04-24T15:16:44Z",
"severity": null
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/vma: fix memory leak in __mmap_region()\n\ncommit 605f6586ecf7 (\"mm/vma: do not leak memory when .mmap_prepare\nswaps the file\") handled the success path by skipping get_file() via\nfile_doesnt_need_get, but missed the error path.\n\nWhen /dev/zero is mmap\u0027d with MAP_SHARED, mmap_zero_prepare() calls\nshmem_zero_setup_desc() which allocates a new shmem file to back the\nmapping. If __mmap_new_vma() subsequently fails, this replacement\nfile is never fput()\u0027d - the original is released by\nksys_mmap_pgoff(), but nobody releases the new one.\n\nAdd fput() for the swapped file in the error path.\n\nReproducible with fault injection.\n\nFAULT_INJECTION: forcing a failure.\nname failslab, interval 1, probability 0, space 0, times 1\nCPU: 2 UID: 0 PID: 366 Comm: syz.7.14 Not tainted 7.0.0-rc6 #2 PREEMPT(full)\nHardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x164/0x1f0\n should_fail_ex+0x525/0x650\n should_failslab+0xdf/0x140\n kmem_cache_alloc_noprof+0x78/0x630\n vm_area_alloc+0x24/0x160\n __mmap_region+0xf6b/0x2660\n mmap_region+0x2eb/0x3a0\n do_mmap+0xc79/0x1240\n vm_mmap_pgoff+0x252/0x4c0\n ksys_mmap_pgoff+0xf8/0x120\n __x64_sys_mmap+0x12a/0x190\n do_syscall_64+0xa9/0x580\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n \u003c/TASK\u003e\n\nkmemleak: 1 new suspected memory leaks (see /sys/kernel/debug/kmemleak)\nBUG: memory leak\nunreferenced object 0xffff8881118aca80 (size 360):\n comm \"syz.7.14\", pid 366, jiffies 4294913255\n hex dump (first 32 bytes):\n 00 00 00 00 ad 4e ad de ff ff ff ff 00 00 00 00 .....N..........\n ff ff ff ff ff ff ff ff c0 28 4d ae ff ff ff ff .........(M.....\n backtrace (crc db0f53bc):\n kmem_cache_alloc_noprof+0x3ab/0x630\n alloc_empty_file+0x5a/0x1e0\n alloc_file_pseudo+0x135/0x220\n __shmem_file_setup+0x274/0x420\n shmem_zero_setup_desc+0x9c/0x170\n mmap_zero_prepare+0x123/0x140\n __mmap_region+0xdda/0x2660\n mmap_region+0x2eb/0x3a0\n do_mmap+0xc79/0x1240\n vm_mmap_pgoff+0x252/0x4c0\n ksys_mmap_pgoff+0xf8/0x120\n __x64_sys_mmap+0x12a/0x190\n do_syscall_64+0xa9/0x580\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nFound by syzkaller.",
"id": "GHSA-cg89-59r4-qfhp",
"modified": "2026-04-24T15:32:37Z",
"published": "2026-04-24T15:32:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-31654"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/61fc8eaf2ab214b32c7bce52597c80cf0ca41ada"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/894f99eb535edc4514f756818f3c4f688ba53a59"
}
],
"schema_version": "1.4.0",
"severity": []
}
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.