{
  "cveId": "CVE-2026-31654",
  "url": "https://patchblox.com/security/cve/CVE-2026-31654",
  "summary": "CVE-2026-31654 is fixed in linux on 1 platform by DEBIAN-CVE-2026-31654 (version 6.19.13-1), released May 15, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  mm/vma: fix memory leak in __mmap_region()  comm...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  mm/vma: fix memory leak in __mmap_region()  commit 605f6586ecf7 (\u0022mm/vma: do not leak memory when .mmap_prepare swaps the file\u0022) handled the success path by skipping get_file() via file_doesnt_need_get, but missed the error path.  When /dev/zero is mmap\u0027d with MAP_SHARED, mmap_zero_prepare() calls shmem_zero_setup_desc() which allocates a new shmem file to back the mapping. If __mmap_new_vma() subsequently fails, this replacement file is never fput()\u0027d - the original is released by ksys_mmap_pgoff(), but nobody releases the new one.  Add fput() for the swapped file in the error path.  Reproducible with fault injection.  FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 1 CPU: 2 UID: 0 PID: 366 Comm: syz.7.14 Not tainted 7.0.0-rc6 #2 PREEMPT(full) Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX \u002B PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace:  \u003CTASK\u003E  dump_stack_lvl\u002B0x164/0x1f0  should_fail_ex\u002B0x525/0x650  should_failslab\u002B0xdf/0x140  kmem_cache_alloc_noprof\u002B0x78/0x630  vm_area_alloc\u002B0x24/0x160  __mmap_region\u002B0xf6b/0x2660  mmap_region\u002B0x2eb/0x3a0  do_mmap\u002B0xc79/0x1240  vm_mmap_pgoff\u002B0x252/0x4c0  ksys_mmap_pgoff\u002B0xf8/0x120  __x64_sys_mmap\u002B0x12a/0x190  do_syscall_64\u002B0xa9/0x580  entry_SYSCALL_64_after_hwframe\u002B0x76/0x7e  \u003C/TASK\u003E  kmemleak: 1 new suspected memory leaks (see /sys/kernel/debug/kmemleak) BUG: memory leak unreferenced object 0xffff8881118aca80 (size 360):   comm \u0022syz.7.14\u0022, pid 366, jiffies 4294913255   hex dump (first 32 bytes):     00 00 00 00 ad 4e ad de ff ff ff ff 00 00 00 00  .....N..........     ff ff ff ff ff ff ff ff c0 28 4d ae ff ff ff ff  .........(M.....   backtrace (crc db0f53bc):     kmem_cache_alloc_noprof\u002B0x3ab/0x630     alloc_empty_file\u002B0x5a/0x1e0     alloc_file_pseudo\u002B0x135/0x220     __shmem_file_setup\u002B0x274/0x420     shmem_zero_setup_desc\u002B0x9c/0x170     mmap_zero_prepare\u002B0x123/0x140     __mmap_region\u002B0xdda/0x2660     mmap_region\u002B0x2eb/0x3a0     do_mmap\u002B0xc79/0x1240     vm_mmap_pgoff\u002B0x252/0x4c0     ksys_mmap_pgoff\u002B0xf8/0x120     __x64_sys_mmap\u002B0x12a/0x190     do_syscall_64\u002B0xa9/0x580     entry_SYSCALL_64_after_hwframe\u002B0x76/0x7e  Found by syzkaller.",
  "published": "2026-04-24T15:16:44Z",
  "severity": "medium",
  "cvss": 5.5,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
  "epss": 0.00113,
  "epssPercentile": 0.01432,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "6.19.13-1",
      "fix": "DEBIAN-CVE-2026-31654",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-31654",
      "released": "2026-05-15T16:01:09Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T13:31:49Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}