UBUNTU-CVE-2026-98224: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: mm/vma: correctly unaccount on mmapprepare() failure mmapsetup() accounts memory for relevant mappings via: securityvmenoughmemorymm() -> vmenoughmemory() -> vmacctmemory() If mmapsetup() fails, this indicates that this accounting did not take place, and thus it's appropriate for mmapregion() to jump to abortmunmap. However if callmmapprepare() fails, it also jumps there and any accounted memory is not correctly unaccounted. Fix this by handling each error separately.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
Which Ubuntu kernel package variants are listed as affected?
The listed variants are ubuntu/linux-riscv, ubuntu/linux-realtime, ubuntu/linux-hwe-edge, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-azure-fde, ubuntu/linux-gke, and ubuntu/linux-aws-5.0.
What runtime condition is required for the accounting issue to occur?
The issue occurs when call_mmap_prepare() fails after memory has been accounted during mmap setup. The failure path then needs to unaccount the memory rather than following the path intended for an earlier __mmap_setup() failure.