CVE-2026-98224

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98224", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.327Z", "datePublished": "2026-10-06T08:44:59.349Z", "dateUpdated": "2026-10-19T09:15:56.109Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:15:56.109Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/vma: correctly unaccount on mmap_prepare() failure\n\n__mmap_setup() accounts memory for relevant mappings via:\n\nsecurity_vm_enough_memory_mm()\n -> __vm_enough_memory()\n -> vm_acct_memory()\n\nIf __mmap_setup() fails, this indicates that this accounting did not take\nplace, and thus it's appropriate for __mmap_region() to jump to\nabort_munmap.\n\nHowever if call_mmap_prepare() fails, it also jumps there and any accounted\nmemory is not correctly unaccounted.\n\nFix this by handling each error separately."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["mm/vma.c"], "versions": [{"version": "c84bf6dd2b836b49bb2662668ff1692350d28236", "lessThan": "fb5400bff669c8bad3d4ec09287d9b461e89e5f1", "status": "affected", "versionType": "git"}, {"version": "c84bf6dd2b836b49bb2662668ff1692350d28236", "lessThan": "8fdc521d438fbf0d22c13d51d55d5dd82d7202b2", "status": "affected", "versionType": "git"}, {"version": "c84bf6dd2b836b49bb2662668ff1692350d28236", "lessThan": "6cc27d82196385fe06853319f74312a7d8019726", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["mm/vma.c"], "versions": [{"version": "6.16", "status": "affected"}, {"version": "0", "lessThan": "6.16", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.54", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.8", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "6.18.54"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "7.2.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/fb5400bff669c8bad3d4ec09287d9b461e89e5f1"}, {"url": "https://git.kernel.org/stable/c/8fdc521d438fbf0d22c13d51d55d5dd82d7202b2"}, {"url": "https://git.kernel.org/stable/c/6cc27d82196385fe06853319f74312a7d8019726"}], "title": "mm/vma: correctly unaccount on mmap_prepare() failure", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["mm/vma.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "fb5400bff669c8bad3d4ec09287d9b461e89e5f1", "status": "affected", "version": "c84bf6dd2b836b49bb2662668ff1692350d28236", "versionType": "git"}, {"lessThan": "8fdc521d438fbf0d22c13d51d55d5dd82d7202b2", "status": "affected", "version": "c84bf6dd2b836b49bb2662668ff1692350d28236", "versionType": "git"}, {"lessThan": "6cc27d82196385fe06853319f74312a7d8019726", "status": "affected", "version": "c84bf6dd2b836b49bb2662668ff1692350d28236", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["mm/vma.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.16"}, {"lessThan": "6.16", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.54", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.8", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/vma: correctly unaccount on mmap_prepare() failure\n\n__mmap_setup() accounts memory for relevant mappings via:\n\nsecurity_vm_enough_memory_mm()\n -> __vm_enough_memory()\n -> vm_acct_memory()\n\nIf __mmap_setup() fails, this indicates that this accounting did not take\nplace, and thus it's appropriate for __mmap_region() to jump to\nabort_munmap.\n\nHowever if call_mmap_prepare() fails, it also jumps there and any accounted\nmemory is not correctly unaccounted.\n\nFix this by handling each error separately."}], "id": "CVE-2026-98224", "lastModified": "2026-10-19T10:18:23.160", "metrics": {}, "published": "2026-10-06T09:18:09.427", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6cc27d82196385fe06853319f74312a7d8019726"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8fdc521d438fbf0d22c13d51d55d5dd82d7202b2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/fb5400bff669c8bad3d4ec09287d9b461e89e5f1"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: mm/vma: correctly unaccount on mmap_prepare() failure", "id": "2546530", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2546530"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-772", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nmm/vma: correctly unaccount on mmap_prepare() failure\n__mmap_setup() accounts memory for relevant mappings via:\nsecurity_vm_enough_memory_mm()\n-> __vm_enough_memory()\n-> vm_acct_memory()\nIf __mmap_setup() fails, this indicates that this accounting did not take\nplace, and thus it's appropriate for __mmap_region() to jump to\nabort_munmap.\nHowever if call_mmap_prepare() fails, it also jumps there and any accounted\nmemory is not correctly unaccounted.\nFix this by handling each error separately.", "A flaw was found in the Linux kernel's memory management subsystem. A local user could cause a Denial of Service (DoS) by triggering a failure during a memory mapping preparation operation. Because the kernel fails to properly release accounted memory when this operation fails, repeated triggers can lead to an accounting leak, artificially exhausting available memory limits and causing subsequent memory requests to fail."], "name": "CVE-2026-98224", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-06T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98224\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98224\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98224.mbox"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c84bf6dd2b836b49bb2662668ff1692350d28236,fb5400bff669c8bad3d4ec09287d9b461e89e5f1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c84bf6dd2b836b49bb2662668ff1692350d28236,8fdc521d438fbf0d22c13d51d55d5dd82d7202b2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c84bf6dd2b836b49bb2662668ff1692350d28236,6cc27d82196385fe06853319f74312a7d8019726)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.16"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.16)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.54,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.8,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.3-rc4,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-06T15:15:14.649387+00:00", "updated": "2026-10-09T16:15:08.032680+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}