CVE-2026-98224: mm/vma: correctly unaccount on mmap_prepare() failure
In the Linux kernel, the following vulnerability has been resolved:
mm/vma: correctly unaccount on mmapprepare() failure
mmapsetup() accounts memory for relevant mappings via:
securityvmenoughmemorymm() -> vmenoughmemory() -> vmacctmemory()
If mmapsetup() fails, this indicates that this accounting did not take place, and thus it's appropriate for mmapregion() to jump to abortmunmap.
However if callmmapprepare() fails, it also jumps there and any accounted memory is not correctly unaccounted.
Fix this by handling each error separately.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
What conditions trigger the accounting error?
The error occurs when call_mmap_prepare() fails after memory has already been accounted during mmap setup. The failure path incorrectly treats this case like an earlier __mmap_setup() failure and does not unaccount the memory.
What is the operational impact of the issue?
Failed mmap preparation can leave memory accounting charged when it should have been released. The provided data does not specify a concrete attacker capability, affected configuration, or externally observable symptom.
Are fixes available?
Yes. The references include three stable Linux kernel commits that resolve the error-handling and memory-unaccounting behavior.