{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.88-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.0.7-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  bpf: Fix use-after-free in arena_vm_close on fork  arena_vm_open() only bumps vml-\u003emmap_count but never registers the child VMA in arena-\u003evma_list. The vml-\u003evma always points at the parent VMA, so after parent munmap the pointer dangles. If the child then calls bpf_arena_free_pages(), zap_pages() reads the stale vml-\u003evma triggering use-after-free.  Fix this by preventing the arena VMA from being inherited across fork with VM_DONTCOPY, and preventing VMA splits via the may_split callback.  Also reject mremap with a .mremap callback returning -EINVAL. A same-size mremap(MREMAP_FIXED) on the full arena VMA reaches copy_vma() through the following path:    check_prep_vma()       - returns 0 early: new_len == old_len                            skips VM_DONTEXPAND check   prep_move_vma()        - vm_start == old_addr and                            vm_end == old_addr + old_len                            so may_split is never called   move_vma()     copy_vma_and_data()       copy_vma()         vm_area_dup()    - copies vm_private_data (vml pointer)         vm_ops-\u003eopen()   - bumps vml-\u003emmap_count       vm_ops-\u003emremap()   - returns -EINVAL, rollback unmaps new VMA  The refcount ensures the rollback's arena_vm_close does not free the vml shared with the original VMA.",
  "id": "DEBIAN-CVE-2026-45837",
  "modified": "2026-09-14T16:47:41.990639824Z",
  "published": "2026-05-27T11:16:23.020Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-45837"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "upstream": [
    "CVE-2026-45837"
  ]
}