In the Linux kernel, the following vulnerability has been resolved:
userfaultfd: prevent registration of special VMAs
Vova Tokarev says:
userfaultfd allows registration on shadow stack VMAs. With userfaultfd access, you can register on the shadow stack, discard a page ... and inject a page with chosen return addresses via UFFDIO_COPY.
Update vma_can_userfault() to reject VM_SHADOW_STACK.
While on it, also reject VM_SPECIAL so that if a driver would implement vm_uffd_ops, it wouldn't be possible to register special VMAs with userfaultfd.
Since VM_SPECIAL includes VM_DONTEXPAND which is set but hugetlb, exclude hugetlb VMAs from the check for VM_SPECIAL.
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade python3-perf6.18-debuginfoUpgrade microvm-kernel6.18Upgrade python3-perf6.18Upgrade bpftool6.18-debuginfoUpgrade kernel6.18-tools-debuginfoUpgrade kernel-livepatch-6.18.44-99.149Upgrade perf6.18Upgrade kernel6.18-debuginfoUpgrade perf6.18-debuginfoUpgrade bpftool6.18Upgrade kernel6.18-develUpgrade kernel6.18-tools-develUpgrade kernel6.18-modules-extra-commonUpgrade kernel6.18-modules-extraUpgrade kernel6.18-headersUpgrade kernel6.18-debuginfo-common-aarch64Upgrade kernel6.18-debuginfo-common-x86_64Upgrade kernel6.18-toolsUpgrade kernel6.18 | Sep 30, 2026 | Aug 10, 2026 |
| Debian | — | Upgrade linuxUpgrade linux-6.12 | Aug 26, 2026 | Aug 26, 2026 |
| Redhat_linux | — | Upgrade kernelUpgrade kernel-rt | Aug 17, 2026 | Aug 10, 2026 |
| Rocky_linux | — | Upgrade kernel-develUpgrade kernel-rt-modules-extraUpgrade libperf-debuginfoUpgrade kernelUpgrade libperfUpgrade kernel-tools-libs-develUpgrade python3-perfUpgrade kernel-modules-coreUpgrade kernel-devel-matchedUpgrade kernel-uki-virt-addonsUpgrade perf-debuginfoUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-rt-debug-modules-extraUpgrade perfUpgrade kernel-debug-devel-matchedUpgrade kernel-zfcpdump-coreUpgrade kernel-zfcpdump-debuginfoUpgrade kernel-rt-coreUpgrade kernel-tools-debuginfoUpgrade kernel-rt-develUpgrade kernel-debug-uki-virtUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-debuginfoUpgrade rvUpgrade kernel-rt-modulesUpgrade kernel-rt-debug-modulesUpgrade kernel-debug-modulesUpgrade kernel-zfcpdump-modulesUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-toolsUpgrade kernel-tools-libsUpgrade kernel-coreUpgrade kernel-rt-debugUpgrade kernel-rt-debug-develUpgrade kernel-zfcpdumpUpgrade kernel-rt-debug-coreUpgrade kernel-debug-modules-coreUpgrade kernel-rt-debuginfoUpgrade kernel-debugUpgrade kernel-uki-virtUpgrade kernel-rt-debug-debuginfoUpgrade kernel-modules-extra-matchedUpgrade kernel-rt-modules-coreUpgrade kernel-debuginfo-common-s390xUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-rt-debug-modules-coreUpgrade kernel-rtUpgrade kernel-modulesUpgrade kernel-debug-modules-extraUpgrade kernel-debug-develUpgrade kernel-debug-debuginfoUpgrade kernel-debug-coreUpgrade rtlaUpgrade python3-perf-debuginfoUpgrade kernel-modules-extraUpgrade kernel-zfcpdump-devel | Sep 7, 2026 | Sep 5, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Sep 15, 2026 | Aug 10, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub