* Re: [SECURITY] mm: mremap() merge silently disarms a userfaultfd VMA
[not found] <10acf436.5b2b.1a1c45e0bb8.Coremail.18670333770@163.com>
@ 2026-11-10 9:03 ` Mike Rapoport
0 siblings, 0 replies; only message in thread
From: Mike Rapoport @ 2026-11-10 9:03 UTC (permalink / raw)
To: n3rd; +Cc: linux-mm, linux-kernel, peterx, ljs, akpm, security
Hi,
On Tue, Nov 10, 2026 at 03:31:00PM +0800, n3rd wrote:
> Hello,
> I am reporting a security bug in the Linux kernel.
> 1. Affected kernel versions
> Linux v7.3-rc7 (mainline, built and tested as 7.3.0-rc7 with KASAN) is
> affected and the issue was reproduced in two fresh QEMU boots plus a
> control boot on it.
...
> 6. Suggested fix
> mremap_userfaultfd_prep() must only drop the context of the range that
> was actually copied, not of a pre-existing VMA that absorbed it. Either
> have copy_vma() report whether it merged into a neighbour and, in that
> case, restrict or skip the reset, or refuse the merge in
> vma_merge_copied_range() when the neighbour is uffd-armed and the
> caller does not have UFFD_FEATURE_EVENT_REMAP. No upstream patch exists
> as of v7.3-rc7 and no patch is included in this report; one can be
> provided on request.
This was already reported [1] and fixed by commit 68cb098eadda ("mm/vma:
avoid broken uffd merge on mremap") that is in v7.4-rc1 and is tagged
for stable.
[1] https://lore.kernel.org/all/20261020110748.959870-1-shawnq1@163.com/
Please check the latest upstream before sending reports.
--
Sincerely yours,
Mike.
^ permalink raw reply [flat|nested] only message in thread