CVE-2026-23056

Root

Cause The uacce driver's vm_operations_struct did not implement the .mremap operation, causing the default mremap behavior to be used. The default mremap copies the original VMA's vm_private_data (which points to the queue structure q) to the new VMA. If an application performs mmap, mremap, munmap on the original address, and then munmap on the new address, both munmap calls trigger vma_close, leading to a double free of q->qfr (though qfr is set to NULL after the first free, the double free is still a bug) [1][2][3].

Exploitation

An attacker with local access and the ability to mmap and mremap a uacce device can trigger this double-free condition. No special privileges beyond access to the uacce device are required. The attack involves a specific sequence of memory operations that exploit the missing mremap restriction [1].

Impact

A double free can lead to memory corruption, potentially allowing an attacker to achieve privilege escalation or cause a denial of service (system crash). The severity is considered moderate as it requires local access and specific conditions [1][2][3].

Mitigation

The fix implements the .mremap callback in uacce_vm_ops to return -EPERM, explicitly disabling mremap on uacce mappings. This prevents the risky memory operations. Users should apply the corresponding stable kernel patches to address CVE-2026-23056 [1][2][3].