CVE-2026-98224 mm/vma: correctly unaccount on mmap_prepare() failure
A local attacker can cause a memory accounting error in the Linux kernel, potentially leading to a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98224?
CVE-2026-98224 is a denial of service vulnerability in Linux, published on 6 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
mm/vma: correctly unaccount on mmap_prepare() failure
__mmap_setup() accounts memory for relevant mappings via:
security_vm_enough_memory_mm() -> __vm_enough_memory() -> vm_acct_memory()
If __mmap_setup() fails, this indicates that this accounting did not take place, and thus it's appropriate for __mmap_region() to jump to abort_munmap.
However if call_mmap_prepare() fails, it also jumps there and any accounted memory is not correctly unaccounted.
Fix this by handling each error separately.
Which versions are affected by CVE-2026-98224?
How do I fix CVE-2026-98224?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-98224 being exploited?
There is no known exploitation of CVE-2026-98224 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-98224, DEBIAN-CVE-2026-98224, GHSA-mpjf-v662-xm2m, UBUNTU-CVE-2026-98224.