CVE-2026-53085

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf: fix mm lifecycle in open-coded task_vma iterator

The open-coded task_vma iterator reads task->mm locklessly and acquires

mmap_read_trylock() but never calls mmget(). If the task exits

concurrently, the mm_struct can be freed as it is not

SLAB_TYPESAFE_BY_RCU, resulting in a use-after-free.

Safely read task->mm with a trylock on alloc_lock and acquire an mm

reference. Drop the reference via bpf_iter_mmput_async() in _destroy()

and error paths. bpf_iter_mmput_async() is a local wrapper around

mmput_async() with a fallback to mmput() on !CONFIG_MMU.

Reject irqs-disabled contexts (including NMI) up front. Operations used

by _next() and _destroy() (mmap_read_unlock, bpf_iter_mmput_async)

take spinlocks with IRQs disabled (pool->lock, pi_lock). Running from

NMI or from a tracepoint that fires with those locks held could

deadlock.

A trylock on alloc_lock is used instead of the blocking task_lock()

(get_task_mm) to a

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References