CVE-2026-23416

The vulnerability is a logic error in the Linux kernel's mseal mechanism for memory sealing. When iterating over VMAs, the code stored the end (curr_end) of the current VMA was saved and then used to set the start (curr_start) of the next VMA. However, if vma_modify_flags() merges the current VMA, curr_end could update curr_end, making it stale. The fix updates curr_end unconditionally to vma->vm_end and simplifies the iteration by clamping curr_start/curr_end to the input range and VMAs [1][3].

Attack

Vector Exploitation requires local access and the ability to trigger VMA merging operations. The bug can cause incorrect VMA tracking when using mseal flags, potentially malforming subsequent memory management operations. No special privileges beyond user-level access are needed if the attacker can induce the merge scenario [1].

Impact

An attacker could cause the kernel to maintain incorrect VMA boundaries, which could lead to unexpected behavior, such as improper sealing of memory regions or memory corruption. This may result in a denial of service or potentially enable further exploitation. The CVSS v3 score of 5.5 (Medium) reflects local access required and moderate impact [1].

Mitigation

Multiple stable kernel trees have backported the fix, as indicated by the commit references [1][2][3]. Users should update to patched versions. There is no known workaround.