CVE-2026-43178

What it actually does

Double mmput() call on an mm_struct in the PROCMAP_QUERY error path after mmap_lock release, resulting in use-after-free or memory corruption.

Why it matters to the business

Local attackers on affected Linux systems can trigger kernel memory corruption, leading to crashes, data corruption, or potential privilege escalation; the issue affects widely used kernels with no fixed versions listed yet, increasing urgency for patching once available.

How an attack unfolds

A local attacker invokes the PROCMAP_QUERY operation with an incorrectly sized build ID buffer, causing the -ENAMETOOLONG error path to execute after mmput() has already occurred, triggering the double free during cleanup.

How to fix it

Apply the upstream kernel patch that adjusts the error jump target to avoid the second mmput(); monitor for distribution updates that include this fix once released.

How to confirm the fix worked

Review kernel source for the corrected goto target in do_procmap_query() after the ENAMETOOLONG return; confirm the double-mmput path is eliminated by code inspection or by testing the error condition.

Typical attack path

1. Obtain local unprivileged access to a vulnerable Linux system
2. Invoke PROCMAP_QUERY ioctl or equivalent with malformed build ID buffer size
3. Trigger the error path that performs the second mmput()
4. Exploit resulting use-after-free for memory corruption or escalation

How to detect it

Search kernel logs and audit trails for repeated PROCMAP_QUERY failures returning ENAMETOOLONG followed by unexpected mm_struct reference counts or oops involving mmput; no public exploitation artifacts are known.

What your security team should do

• Prioritize kernel updates containing this fix once available from distributions
• Restrict unprivileged local access where possible until patched
• Monitor EPSS and KEV status for changes indicating increased exploitation risk