This was submitted for 2.6.26-rc8-mm1 but it must have gotten overlooked:
diff --git a/mm/mmap.c b/mm/mmap.c
index 4c5211b..3d65a03 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -372,7 +372,7 @@ find_vma_prepare(struct mm_struct *mm, unsigned long addr,
if (vma_tmp->vm_end > addr) {
vma = vma_tmp;
if (vma_tmp->vm_start <= addr)
- return vma;
+ break;
__rb_link = &__rb_parent->rb_left;
} else {
rb_prev = __rb_parent;
--