CVE-2026-74354

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the bpf component where zap vma range() requires the owning mm's mmap lock to be held. Attempting to take mmap read lock while holding arena->lock creates an AB-BA deadlock condition against arena vm close() and arena map mmap(), as both of these functions acquire mmap write lock before acquiring arena->lock. To resolve this, the system must drop arena->lock, use mmget not zero() for the vma's mm, acquire mmap read lock, and re-resolve the vma using find vma() to account for potential unmapping or replacement. Additionally, processed vmls are tracked via a per-call generation in vml->zap gen, and zap pages() callers are serialized using a new arena->zap mutex to prevent concurrent callers on different uaddr ranges from incorrectly marking vmls as processed.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.