Medium 5.5Published May 6, 2026

CVE-2026-43109x86: shadow stacks: proper error handling for mmap lock

Updated under an hour ago (Oct 27, 2026, 9:10 PM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: x86: shadow stacks: proper error handling for mmap lock 김영민 reports that shstk_pop_sigframe() doesn't check for errors from mmap_read_lock_killable(), which is a silly oversight, and also shows that we haven't marked those functions with "__must_check", which would have immediately caught it. So let's fix both issues.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: May 17, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 7fad2a432cd35bbf104d2d9d426e74902f22aa95 before c79cf42321600e931933e11f94aba8b245d4cd66; 7fad2a432cd35bbf104d2d9d426e74902f22aa95 builds before 1a30468eff661937d978495644d2e5ebfeef5ce6; from 7fad2a432cd35bbf104d2d9d426e74902f22aa95 before c64cebcc5c4f223dbcbe7dcdf74908fc092a0aa4; from 7fad2a432cd35bbf104d2d9d426e74902f22aa95 before 262b6d38a81d51b135db81e1f30c13d30e38feee; from 7fad2a432cd35bbf104d2d9d426e74902f22aa95 before 52f657e34d7b21b47434d9d8b26fa7f6778b63a0	CNA record
linux linux_kernel linux:linux_kernel	from 6.6 before 6.18.24; from 6.19 before 6.19.14; 7.0; 7.0; 7.0; 7.0; 7.0; 7.0; and 1 more ranges	NVD

References

References

https://git.kernel.org/stable/c/c79cf42321600e931933e11f94aba8b245d4cd66
https://git.kernel.org/stable/c/1a30468eff661937d978495644d2e5ebfeef5ce6
https://git.kernel.org/stable/c/c64cebcc5c4f223dbcbe7dcdf74908fc092a0aa4	patch
https://git.kernel.org/stable/c/262b6d38a81d51b135db81e1f30c13d30e38feee	patch
https://git.kernel.org/stable/c/52f657e34d7b21b47434d9d8b26fa7f6778b63a0	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.