CVE-2026-46100

HighCVSS 7.8/10Last modified Jun 25, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

fs: afs: revert mmap_prepare() change

Partially reverts commit 9d5403b1036c ("fs: convert most other generic_file_*mmap() users to .mmap_prepare()").

This is because the .mmap invocation establishes a refcount, but .mmap_prepare is called at a point where a merge or an allocation failure might happen after the call, which would leak the refcount increment.

Functionality is being added to permit the use of .mmap_prepare in this case, but in the interim, we need to fix this.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

VendorProductVersions
LinuxLinux>= 9d5403b1036cdcd4be0f9f5568612c0e60e73d79, < f51f85c044809fbd39ac8ae07ac99bc43ce32bd5; >= 9d5403b1036cdcd4be0f9f5568612c0e60e73d79, < 48c7a0eaeea41da17d1d84d2d7a4c40be122b246; >= 9d5403b1036cdcd4be0f9f5568612c0e60e73d79, < fbfc6578eaca12daa0c09df1e9ba7f2c657b49da
LinuxLinux6.17

References

Timeline

Published
May 27, 2026
Last modified
Jun 25, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-461015.5In the Linux kernel, the following vulnerability has been resolved: netfilter: reject zero shift in nft_bitwise Reject zero shift operandsCVE-2026-461027.5In the Linux kernel, the following vulnerability has been resolved: net: strparser: fix skb_head leak in strp_abort_strp() When the streamCVE-2026-461035.5In the Linux kernel, the following vulnerability has been resolved: can: ucan: fix devres lifetime USB drivers bind to USB interfaces and CVE-2026-461045.5In the Linux kernel, the following vulnerability has been resolved: selinux: use sk blob accessor in socket permission helpers SELinux socCVE-2026-461057.8In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Limit NVMe request size to 2 MiB The HBA firmware reporCVE-2026-461065.5In the Linux kernel, the following vulnerability has been resolved: eventfs: Hold eventfs_mutex and SRCU when remount walks events Commit CVE-2026-461077.8In the Linux kernel, the following vulnerability has been resolved: dm-thin: fix metadata refcount underflow There's a bug in dm-thin in tCVE-2026-461085.5In the Linux kernel, the following vulnerability has been resolved: ipmi:si: Return state to normal if message allocation fails There wereCVE-2026-461095.5In the Linux kernel, the following vulnerability has been resolved: usb: ulpi: fix memory leak on ulpi_register() error paths Commit 01af5CVE-2026-46118.8A flaw has been found in TOTOLINK X6000R 9.4.0cu.1360_B20241207/9.4.0cu.1498_B20250826. Affected by this issue is the function setLanCfg of CVE-2026-461107.5In the Linux kernel, the following vulnerability has been resolved: net: stmmac: Prevent NULL deref when RX memory exhausted The CPU receiCVE-2026-461117.8In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_conn: fix potential UAF in create_big_sync Add hci_conn
CVE-2026-46100: High severity, CVSS 7.8 | Vulnix