CVE-2026-45837

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix use-after-free in arena_vm_close on fork

arena_vm_open() only bumps vml->mmap_count but never registers the

child VMA in arena->vma_list. The vml->vma always points at the

parent VMA, so after parent munmap the pointer dangles. If the child

then calls bpf_arena_free_pages(), zap_pages() reads the stale

vml->vma triggering use-after-free.

Fix this by preventing the arena VMA from being inherited across

fork with VM_DONTCOPY, and preventing VMA splits via the may_split

callback.

Also reject mremap with a .mremap callback returning -EINVAL. A

same-size mremap(MREMAP_FIXED) on the full arena VMA reaches

copy_vma() through the following path:

check_prep_vma() - returns 0 early: new_len == old_len

skips VM_DONTEXPAND check

prep_move_vma() - vm_start == old_addr and

vm_end == old_addr + old_len

so may_split is never

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References