Taking a page from the kernel's book: A TLB issue in mremap()
Summary: Jann Horn of Google Project Zero disclosed CVE-2018-18281, a Linux kernel bug in which mremap()'s move_ptes() releases a page reference before the TLB flush on the old address range, leaving a race window in which another task can free the page. On kernels from v4.9 onward the large race window only permits use-after-free reads, but before commit 5d1904204c99 (November 2016) it also permitted use-after-free writes.
Bottom line: A TLB flush ordered too late turns a routine memory-management path into a use-after-free primitive for a local attacker, and the write-capable variant existed in every kernel before v4.9 - a version many long-lived systems still run.
Read the original at Google Project Zero ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2016-5195CVE-2017-15588CVE-2018-1038CVE-2018-18281
- Related
- CVE-2016-5195: Linux Kernel Race Condition Vulnerability Known Exploited Vulnerabilities · Mar 03, 2022Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026