CVE-2026-23380: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23380 is a reference counting flaw in the Linux kernel's tracing subsystem, specifically within the tracing_buffers_mmap_close() function. When a process forks, the child copies the parent's Virtual Memory Areas (VMAs) without incrementing the user_mapped reference count; when both processes exit, the close function is called twice, triggering a WARN_ON kernel assertion on the second call. Affected kernel versions include 6.10, 6.10.1–6.12.76, 6.13–6.18.16, 6.19–6.19.6, and 7.0-rc1 through 7.0-rc2. It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-911 (Improper Update of Reference Count) and CWE-617 (Reachable Assertion). Normally, the mapped memory region has VM_DONTCOPY set, which prevents child processes from inheriting the VMA on fork — but this flag is only a hint and can be overridden by an application calling madvise(MADVISE_DOFORK). Once VM_DONTCOPY is cleared, a fork causes the child to inherit the VMA without incrementing user_mapped; when both parent and child exit, tracing_buffers_mmap_close() is invoked twice, and the second invocation finds user_mapped == 0, returning -ENODEV and firing a WARN_ON. The fix increments the user_mapped reference count in the VMA's open callback without re-mapping the pages (Red Hat Bugzilla, Kernel Patch).

Successful exploitation results in a denial-of-service condition through kernel assertion failures that destabilize the kernel tracing subsystem. An unprivileged local attacker with low-privilege access can trigger kernel WARN_ON messages, potentially causing system instability or disruption of tracing functionality. There is no impact on confidentiality or integrity — only availability is affected (Red Hat Advisory).

No public proof-of-concept exploit is known, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires local access with low privileges and the ability to call madvise(MADVISE_DOFORK) on traced memory regions followed by a fork operation (Red Hat Advisory).

1. Gain local access: Obtain a low-privileged local user account on a system running a vulnerable Linux kernel version (6.10, 6.10.1–6.12.76, 6.13–6.18.16, 6.19–6.19.6, or 7.0-rc1/rc2).
2. Open a tracing buffer: Open a file descriptor to a kernel tracing buffer (e.g., /sys/kernel/debug/tracing/trace_pipe_raw or similar) and mmap() it into the process's address space.
3. Override VM_DONTCOPY: Call madvise(addr, length, MADV_DOFORK) on the mapped tracing buffer region to reset the VM_DONTCOPY flag, allowing the VMA to be inherited by child processes on fork.
4. Fork the process: Call fork() so the child process inherits the parent's VMA for the tracing buffer without incrementing the user_mapped reference count.
5. Trigger double-close: Allow both the parent and child processes to exit (or close the mapping), causing tracing_buffers_mmap_close() to be called twice — the second call finds user_mapped == 0, triggers WARN_ON, and returns -ENODEV, resulting in a denial-of-service condition (Red Hat Bugzilla).

• Logs: Kernel log messages (via dmesg or /var/log/kern.log) containing WARN_ON or WARNING: entries referencing tracing_buffers_mmap_close or the tracing subsystem; error codes -ENODEV appearing in tracing-related kernel stack traces.
• Process Behavior: Processes making madvise(MADV_DOFORK) syscalls on memory regions associated with kernel tracing buffer file descriptors, followed immediately by fork() calls — detectable via strace or auditd syscall monitoring.
• File System: Unusual or repeated access to /sys/kernel/debug/tracing/ buffer files (e.g., trace_pipe_raw, per_cpu/cpuX/trace_pipe_raw) by non-root processes.

Apply the upstream kernel patches available for the following fixed versions: 6.12.77, 6.18.17, 6.19.7, and 7.0-rc3 or later. Patches are available from the Linux stable tree with commit hashes 91f3e8d84c89, b0f269ba6fef, cdd96641b642, and e39bb9e02b68. Distribution-specific updates are available from Red Hat, Amazon Linux (ALAS2023-2026-1543, ALAS2023-2026-1596), SUSE (SUSE-SU-2026:22048-1), and others. As a temporary workaround for systems that cannot be patched immediately, restrict unprivileged access to kernel tracing debugfs interfaces and monitor for kernel warning messages related to tracing_buffers_mmap_close (Red Hat Advisory, Red Hat Bugzilla).