# CVE-2026-31654: linux: In the Linux kernel, the following vulnerability has been resolved:  mm/vma: fix memory leak in __mmap_region()  comm...

CVE-2026-31654 is fixed in linux on 1 platform by DEBIAN-CVE-2026-31654 (version 6.19.13-1), released May 15, 2026. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2026-31654
- Priority: Routine
- CVSS: 5.5 (medium)
- EPSS: 0.0011
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Apr 24, 2026

## Description

In the Linux kernel, the following vulnerability has been resolved:  mm/vma: fix memory leak in __mmap_region()  commit 605f6586ecf7 ("mm/vma: do not leak memory when .mmap_prepare swaps the file") handled the success path by skipping get_file() via file_doesnt_need_get, but missed the error path.  When /dev/zero is mmap'd with MAP_SHARED, mmap_zero_prepare() calls shmem_zero_setup_desc() which allocates a new shmem file to back the mapping. If __mmap_new_vma() subsequently fails, this replacement file is never fput()'d - the original is released by ksys_mmap_pgoff(), but nobody releases the new one.  Add fput() for the swapped file in the error path.  Reproducible with fault injection.  FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 1 CPU: 2 UID: 0 PID: 366 Comm: syz.7.14 Not tainted 7.0.0-rc6 #2 PREEMPT(full) Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace:  <TASK>  dump_stack_lvl+0x164/0x1f0  should_fail_ex+0x525/0x650  should_failslab+0xdf/0x140  kmem_cache_alloc_noprof+0x78/0x630  vm_area_alloc+0x24/0x160  __mmap_region+0xf6b/0x2660  mmap_region+0x2eb/0x3a0  do_mmap+0xc79/0x1240  vm_mmap_pgoff+0x252/0x4c0  ksys_mmap_pgoff+0xf8/0x120  __x64_sys_mmap+0x12a/0x190  do_syscall_64+0xa9/0x580  entry_SYSCALL_64_after_hwframe+0x76/0x7e  </TASK>  kmemleak: 1 new suspected memory leaks (see /sys/kernel/debug/kmemleak) BUG: memory leak unreferenced object 0xffff8881118aca80 (size 360):   comm "syz.7.14", pid 366, jiffies 4294913255   hex dump (first 32 bytes):     00 00 00 00 ad 4e ad de ff ff ff ff 00 00 00 00  .....N..........     ff ff ff ff ff ff ff ff c0 28 4d ae ff ff ff ff  .........(M.....   backtrace (crc db0f53bc):     kmem_cache_alloc_noprof+0x3ab/0x630     alloc_empty_file+0x5a/0x1e0     alloc_file_pseudo+0x135/0x220     __shmem_file_setup+0x274/0x420     shmem_zero_setup_desc+0x9c/0x170     mmap_zero_prepare+0x123/0x140     __mmap_region+0xdda/0x2660     mmap_region+0x2eb/0x3a0     do_mmap+0xc79/0x1240     vm_mmap_pgoff+0x252/0x4c0     ksys_mmap_pgoff+0xf8/0x120     __x64_sys_mmap+0x12a/0x190     do_syscall_64+0xa9/0x580     entry_SYSCALL_64_after_hwframe+0x76/0x7e  Found by syzkaller.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 14 | 6.19.13-1 | [DEBIAN-CVE-2026-31654](https://patchblox.com/security/data/fix/linux/debian-cve-2026-31654.md) | May 15, 2026 |

---

Data as of 2026-11-09T13:31:49Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.