CVE-2026-45837

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix use-after-free in arenavmclose on fork

arenavmopen() only bumps vml->mmapcount but never registers the child VMA in arena->vmalist. The vml->vma always points at the parent VMA, so after parent munmap the pointer dangles. If the child then calls bpfarenafreepages(), zappages() reads the stale vml->vma triggering use-after-free.

Fix this by preventing the arena VMA from being inherited across fork with VMDONTCOPY, and preventing VMA splits via the maysplit callback.

Also reject mremap with a .mremap callback returning -EINVAL. A same-size mremap(MREMAPFIXED) on the full arena VMA reaches copyvma() through the following path:

checkprepvma() - returns 0 early: newlen == oldlen skips VMDONTEXPAND check prepmovevma() - vmstart == oldaddr and vmend == oldaddr + oldlen so maysplit is never called movevma() copyvmaanddata() copyvma() vmareadup() - copies vmprivatedata (vml pointer) vmops->open() - bumps vml->mmapcount vm_ops->mremap() - returns -EINVAL, rollback unmaps new VMA

The refcount ensures the rollback's arenavmclose does not free the vml shared with the original VMA.