bpf: fix mm lifecycle in open-coded task_vma iterator

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-53085
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-06-24 17:17:22 UTC
Updated2026-07-15 01:16:28 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: bpf: fix mm lifecycle in open-coded task_vma iterator The open-coded task_vma iterator reads task->mm locklessly and acquires mmap_read_trylock() but never calls mmget(). If the task exits concurrently, the mm_struct can be freed as it is not SLAB_TYPESAFE_BY_RCU, resulting in a use-after-free. Safely read task->mm with a trylock on alloc_lock and acquire an mm reference. Drop the reference via bpf_iter_mmput_async() in _destroy() and error paths. bpf_iter_mmput_async() is a local wrapper around mmput_async() with a fallback to mmput() on !CONFIG_MMU. Reject irqs-disabled contexts (including NMI) up front. Operations used by _next() and _destroy() (mmap_read_unlock, bpf_iter_mmput_async) take spinlocks with IRQs disabled (pool->lock, pi_lock). Running from NMI or from a tracepoint that fires with those locks held could deadlock. A trylock on alloc_lock is used instead of the blocking task_lock() (get_task_mm) to avoid a deadlock when a softirq BPF program iterates a task that already holds its alloc_lock on the same CPU.

Risk And Classification

Primary CVSS: v3.1 6.4 MEDIUM from ADP

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.001130000 probability, percentile 0.017010000 (date 2026-07-17)

Problem Types: CWE-825 | CWE-825 Expired Pointer Dereference

VersionSourceTypeScoreSeverityVector
3.1ADPCVSS6.4MEDIUMCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
3.1416baaa9-dc9f-4396-8d5f-8c081fb06d67Secondary7.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
3.10b0ca135-0b70-47e7-9f44-1890c2a1c46cSecondary6.4MEDIUMCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
3.1CNADECLARED7.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1 Breakdown

Attack Vector
Local
Attack Complexity
High
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected 4ac4546821584736798aaa9e97da9f6eaf689ea3 239cec25a22662dbd80f57d94b38178c8be95269 git Not specified
CNA Linux Linux affected 4ac4546821584736798aaa9e97da9f6eaf689ea3 d0862de7c866c5bd7c32531f66738c21197af888 git Not specified
CNA Linux Linux affected 4ac4546821584736798aaa9e97da9f6eaf689ea3 43683bb280330f3d36f0f2a3932a4867b9603e9c git Not specified
CNA Linux Linux affected 4ac4546821584736798aaa9e97da9f6eaf689ea3 d8e27d2d22b6e2df3a0125b8c08e9aace38c954c git Not specified
CNA Linux Linux affected 6.7 Not specified
CNA Linux Linux unaffected 6.7 semver Not specified
CNA Linux Linux unaffected 6.12.91 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.33 6.18.* semver Not specified
CNA Linux Linux unaffected 7.0.10 7.0.* semver Not specified
CNA Linux Linux unaffected 7.1 * original_commit_for_fix Not specified
ADP Red Hat Red Hat Enterprise Linux 10 Not specified Not specified
ADP Red Hat Red Hat Enterprise Linux 6 Not specified Not specified
ADP Red Hat Red Hat Enterprise Linux 7 Not specified Not specified
ADP Red Hat Red Hat Enterprise Linux 7 Not specified Not specified
ADP Red Hat Red Hat Enterprise Linux 8 Not specified Not specified
ADP Red Hat Red Hat Enterprise Linux 8 Not specified Not specified
ADP Red Hat Red Hat Enterprise Linux 9 Not specified Not specified
ADP Red Hat Red Hat Enterprise Linux 9 Not specified Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/239cec25a22662dbd80f57d94b38178c8be95269 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53085.json 0b0ca135-0b70-47e7-9f44-1890c2a1c46c security.access.redhat.com
git.kernel.org/stable/c/43683bb280330f3d36f0f2a3932a4867b9603e9c 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
access.redhat.com/security/cve/CVE-2026-53085 0b0ca135-0b70-47e7-9f44-1890c2a1c46c access.redhat.com
git.kernel.org/stable/c/d8e27d2d22b6e2df3a0125b8c08e9aace38c954c 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/d0862de7c866c5bd7c32531f66738c21197af888 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
bugzilla.redhat.com/show_bug.cgi 0b0ca135-0b70-47e7-9f44-1890c2a1c46c bugzilla.redhat.com
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

Additional Advisory Data

SourceTimeEvent
ADP2026-06-24T00:00:00.000ZReported to Red Hat.
ADP2026-06-24T00:00:00.000ZMade public.

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report