CVE-2026-45837

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix use-after-free in arena_vm_close on fork

arena_vm_open() only bumps vml->mmap_count but never registers the

child VMA in arena->vma_list. The vml->vma always points at the

parent VMA, so after parent munmap the pointer dangles. If the child

then calls bpf_arena_free_pages(), zap_pages() reads the stale

vml->vma triggering use-after-free.

Fix this by preventing the arena VMA from being inherited across

fork with VM_DONTCOPY, and preventing VMA splits via the may_split

callback.

Also reject mremap with a .mremap callback returning -EINVAL. A

same-size mremap(MREMAP_FIXED) on the full arena VMA reaches

copy_vma() through the following path:

check_prep_vma() - returns 0 early: new_len == old_len

skips VM_DONTEXPAND check

prep_move_vma() - vm_start == old_addr and

vm_end == old_addr + old_len

so may_split is never called

move_vma()

copy_vma_and_data()

copy_vma()

vm_area_dup() - copies vm_private_data (vml pointer)

vm_ops->open() - bumps vml->mmap_count

vm_ops->mremap() - returns -EINVAL, rollback unmaps new VMA

The refcount ensures the rollback's arena_vm_close does not free

the vml shared with the original VMA.