{"id":"CVE-2026-74354","summary":"bpf: Take mmap_lock in zap_pages()","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Take mmap_lock in zap_pages()\n\nzap_vma_range() requires the owning mm's mmap_lock to be held.\n\nTaking mmap_read_lock under arena-\u003elock would AB-BA against\narena_vm_close() and arena_map_mmap(), both of which run with\nmmap_write_lock held and then acquire arena-\u003elock. Instead drop\narena-\u003elock, mmget_not_zero() the vma's mm, take mmap_read_lock, and\nre-resolve the vma via find_vma() since it may have been unmapped or\nreplaced while waiting.\n\nTrack processed vmls with a per-call generation in vml-\u003ezap_gen and\nserialize zap_pages() callers with a new arena-\u003ezap_mutex so\nconcurrent callers on different uaddr ranges do not mark each other's\nvmls processed before the zap is done.","modified":"2026-08-16T03:48:49.810599666Z","published":"2026-08-15T05:58:40.067Z","database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/74xxx/CVE-2026-74354.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/36b1d997866f6083d33934983aa2ce0a184ed642"},{"type":"WEB","url":"https://git.kernel.org/stable/c/80b89d0226a05e8b67969de99c31b51fcd54f76a"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/74xxx/CVE-2026-74354.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74354"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"317460317a02a1af512697e6e964298dedd8a163"},{"fixed":"36b1d997866f6083d33934983aa2ce0a184ed642"},{"fixed":"80b89d0226a05e8b67969de99c31b51fcd54f76a"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-74354.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.9.0"},{"fixed":"7.1.5"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-74354.json"}}],"schema_version":"1.9.0"}