Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-23416— mm/mseal: update VMA end correctly on merge

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于mm mseal在合并VMA时未正确更新结束地址，可能导致逻辑错误。

AI Predicted 3.3 Difficulty: Moderate EPSS 0.22% · P12

Possible ATT&CK Techniques 1 AI

T1068 · Exploitation for Privilege Escalation

Affected Version Matrix 8

VendorProduct Version RangeStatus
Linux Linux 6c2da14ae1e0a0146587381594559027bd46c059< 40b3f4700e5535fbe74738cebb9379a40ec66bed affected
6c2da14ae1e0a0146587381594559027bd46c059< 83737e34b83a23b2a9bcf586b058b2c2a54c7c6b affected
6c2da14ae1e0a0146587381594559027bd46c059< 2697dd8ae721db4f6a53d4f4cbd438212a80f8dc affected
6.17 affected
< 6.17 unaffected
6.18.21≤ 6.18.* unaffected
6.19.11≤ 6.19.* unaffected
7.0≤ * unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-23416

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
mm/mseal: update VMA end correctly on merge
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: mm/mseal: update VMA end correctly on merge Previously we stored the end of the current VMA in curr_end, and then upon iterating to the next VMA updated curr_start to curr_end to advance to the next VMA. However, this doesn't take into account the fact that a VMA might be updated due to a merge by vma_modify_flags(), which can result in curr_end being stale and thus, upon setting curr_start to curr_end, ending up with an incorrect curr_start on the next iteration. Resolve the issue by setting curr_end to vma->vm_end unconditionally to ensure this value remains updated should this occur. While we're here, eliminate this entire class of bug by simply setting const curr_[start/end] to be clamped to the input range and VMAs, which also happens to simplify the logic.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于mm mseal在合并VMA时未正确更新结束地址，可能导致逻辑错误。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 6c2da14ae1e0a0146587381594559027bd46c059 ~ 40b3f4700e5535fbe74738cebb9379a40ec66bed -
Linux Linux 6.17 -

II. Public POCs for CVE-2026-23416

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-23416

请登录查看更多情报信息。

Same Patch Batch · Linux · 2026-04-02 · 6 CVEs total

CVE-2026-23415 7.8 HIGH futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy()
CVE-2026-23413 7.8 HIGH clsact: Fix use-after-free in init/destroy rollback asymmetry
CVE-2026-23412 7.8 HIGH netfilter: bpf: defer hook memory release until rcu readers are done
CVE-2026-23414 7.5 HIGH tls: Purge async_hold in tls_decrypt_async_wait()
CVE-2026-23417 bpf: Fix constant blinding for PROBE_MEM32 stores

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-23416

No comments yet

Leave a comment