The changelog for commit d6dd61c831226f9cd7750885da04d360d6455101 says arch_dup_mmap, which is called when a new mmap is created at fork Is there a reason that you're not tracking mm creation in exec? Jeff -