CVE-2026-23056

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The Linux kernel’s user-space accelerated copy engine (uacce) implementation lacks support for the mremap operation within the vm operations struct. Implementing .mremap to return -EPERM informs users that the operation is not supported. Without this explicit disabling, the default mremap method is used, which can lead to a double-free condition. Specifically, an application could mmap address p1, then mremap to p2, followed by munmap(p1), and finally munmap(p2). The default mremap copies the original vma’s vm private data (represented as q) to the new vma. Consequently, both munmap operations trigger vma close, resulting in the q->qfr being freed twice. The qfr is set to null during the release, mitigating the impact, but still representing a potential issue.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.