CVE-2026-53373 Overview
CVE-2026-53373 is a Linux kernel vulnerability in the memory management subsystem. The flaw resides in the mm/vma code path where mmap_prepare() is invoked from the mmap() hook of stacked drivers such as overlayfs and shm. When an error occurs during mmap_prepare action processing, the kernel attempts to unmap a Virtual Memory Area (VMA) that is not fully established in the maple tree. This triggers a warning in vma_mark_detached() because the VMA is already detached. The issue affects local kernel stability and reliability of memory-mapped file operations.
Critical Impact
Local low-privileged users can trigger kernel warnings and potentially destabilize memory-mapped I/O paths involving stacked filesystems, leading to high impact on confidentiality, integrity, and availability.
Affected Products
- Linux kernel versions containing the mmap_prepare hook with stacked driver invocation
- Systems using stacked drivers such as overlayfs and shm
- Distributions shipping the affected upstream kernel commits prior to the fix
Discovery Timeline
- 2026-07-19 - CVE-2026-53373 published to NVD
- 2026-07-20 - Last updated in NVD database
Technical Details for CVE-2026-53373
Vulnerability Analysis
The Linux kernel's mmap_prepare hook allows stacked drivers to invoke mmap_prepare() from within their own mmap() handler. Stacked drivers such as overlayfs and shm chain mmap operations to underlying filesystems or drivers. The mmap_prepare action layer includes error handling that unmaps the VMA when a failure occurs during setup.
In the standard mmap_prepare path, this cleanup is safe because the action runs at the last moment, once the VMA has been inserted into the maple tree. However, when mmap_prepare() is invoked from an mmap() hook, the VMA pointer passed to the caller is not fully established and remains detached from the maple tree. Attempting to unmap a detached VMA triggers a warning in vma_mark_detached() and produces inconsistent kernel state.
Root Cause
The root cause is a missing distinction between direct mmap_prepare invocation and invocation through the mmap() compatibility layer. The cleanup logic assumes the VMA is fully established, which does not hold when a stacked driver calls mmap_prepare() from its mmap() hook. The mmap() handler is already responsible for cleaning up the VMA on error, so the additional unmap attempt is both incorrect and unnecessary.
Attack Vector
A local user with the ability to invoke memory-mapped I/O against a stacked filesystem such as overlayfs or SysV shared memory can reach the vulnerable code path. Triggering an error condition during the nested mmap_prepare() call causes the kernel to attempt cleanup of a detached VMA. This produces a WARN_ON splat in vma_mark_detached() and leaves the kernel in an inconsistent state that impacts subsequent VMA operations.
No verified public exploit code is available for this issue. Technical details are documented in the upstream kernel commits 5394bcb and 619eab2.
Detection Methods for CVE-2026-53373
Indicators of Compromise
- Kernel log entries containing WARN traces originating from vma_mark_detached()
- Stack traces referencing mmap_prepare, __mmap_region, or stacked driver mmap handlers such as ovl_mmap or shm_mmap
- Unexpected mmap() failures on overlayfs mounts or SysV shared memory segments
Detection Strategies
- Monitor dmesg and /var/log/kern.log for repeated vma_mark_detached warnings correlated with local user workloads
- Correlate userland process activity performing mmap() on overlayfs or shm with kernel warning events
- Track kernel version and patch status across the fleet to identify unpatched hosts exposed to the flaw
Monitoring Recommendations
- Ingest kernel logs into a centralized logging or SIEM platform and alert on vma_mark_detached warnings
- Baseline normal mmap() failure rates on hosts using containerized workloads that depend on overlayfs
- Audit which local users and containers have access to invoke mmap() against stacked filesystems
How to Mitigate CVE-2026-53373
Immediate Actions Required
- Apply the upstream kernel patches from commits 5394bcb and 619eab2
- Update to a distribution kernel package that incorporates these fixes
- Restrict untrusted local access to hosts that expose overlayfs mounts and SysV shared memory
Patch Information
The upstream fix propagates whether an mmap action is completed through the compatibility layer or directly. When invoked via the compatibility layer from mmap(), the kernel no longer attempts to unmap the detached VMA and defers cleanup to the mmap() handler. The patch also updates the userland VMA tests to reflect the new behavior. Rebuild or reinstall the kernel package after applying the referenced commits.
Workarounds
- Limit local shell access on multi-tenant systems until patched kernels are deployed
- Reduce reliance on stacked filesystems such as overlayfs for untrusted workloads where feasible
- Apply mandatory access control policies (SELinux, AppArmor) to constrain processes that can invoke mmap() on affected paths
# Verify running kernel version and check for the fix
uname -r
git -C /usr/src/linux log --oneline | grep -E "5394bcb|619eab2"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
