CVE-2026-23380

In the Linux kernel, the following vulnerability has been resolved:

tracing: Fix WARNON in tracingbuffersmmapclose

When a process forks, the child process copies the parent's VMAs but the usermapped reference count is not incremented. As a result, when both the parent and child processes exit, tracingbuffersmmapclose() is called twice. On the second call, usermapped is already 0, causing the function to return -ENODEV and triggering a WARNON.

Normally, this isn't an issue as the memory is mapped with VMDONTCOPY set. But this is only a hint, and the application can call madvise(MADVISEDOFORK) which resets the VM_DONTCOPY flag. When the application does that, it can trigger this issue on fork.

Fix it by incrementing the user_mapped reference count without re-mapping the pages in the VMA's open callback.