CVE-2026-23416

In the Linux kernel, the following vulnerability has been resolved:

mm/mseal: update VMA end correctly on merge

Previously we stored the end of the current VMA in currend, and then upon iterating to the next VMA updated currstart to curr_end to advance to the next VMA.

However, this doesn't take into account the fact that a VMA might be updated due to a merge by vmamodifyflags(), which can result in currend being stale and thus, upon setting currstart to currend, ending up with an incorrect currstart on the next iteration.

Resolve the issue by setting currend to vma->vmend unconditionally to ensure this value remains updated should this occur.

While we're here, eliminate this entire class of bug by simply setting const curr_[start/end] to be clamped to the input range and VMAs, which also happens to simplify the logic.