{"id":"CVE-2026-53085","revision":"244f3e5406ba4cb6951a7787940cb8af","records":[{"revision":"244f3e5406ba4cb6951a7787940cb8af","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-53085","aliases":[],"title":"bpf: fix mm lifecycle in open-coded task_vma iterator","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: fix mm lifecycle in open-coded task_vma iterator\n\nThe open-coded task_vma iterator reads task->mm locklessly and acquires\nmmap_read_trylock() but never calls mmget(). If the task exits\nconcurrently, the mm_struct can be freed as it is not\nSLAB_TYPESAFE_BY_RCU, resulting in a use-after-free.\n\nSafely read task->mm with a trylock on alloc_lock and acquire an mm\nreference. Drop the reference via bpf_iter_mmput_async() in _destroy()\nand error paths. bpf_iter_mmput_async() is a local wrapper around\nmmput_async() with a fallback to mmput() on !CONFIG_MMU.\n\nReject irqs-disabled contexts (including NMI) up front. Operations used\nby _next() and _destroy() (mmap_read_unlock, bpf_iter_mmput_async)\ntake spinlocks with IRQs disabled (pool->lock, pi_lock). Running from\nNMI or from a tracepoint that fires with those locks held could\ndeadlock.\n\nA trylock on alloc_lock is used instead of the blocking task_lock()\n(get_task_mm) to avoid a deadlock when a softirq BPF program iterates\na task that already holds its alloc_lock on the same CPU.","state":0,"publishedAt":"2026-06-24T16:30:25.232+00:00","modifiedAt":"2026-10-19T19:47:16.049+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"kernel/bpf/task_iter.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"4ac4546821584736798aaa9e97da9f6eaf689ea3\",\n                            \"lessThan\": \"239cec25a22662dbd80f57d94b38178c8be95269\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"4ac4546821584736798aaa9e97da9f6eaf689ea3\",\n                            \"lessThan\": \"d0862de7c866c5bd7c32531f66738c21197af888\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"4ac4546821584736798aaa9e97da9f6eaf689ea3\",\n                            \"lessThan\": \"43683bb280330f3d36f0f2a3932a4867b9603e9c\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"4ac4546821584736798aaa9e97da9f6eaf689ea3\",\n                            \"lessThan\": \"d8e27d2d22b6e2df3a0125b8c08e9aace38c954c\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"kernel/bpf/task_iter.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.7\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.7\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.91\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.33\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.0.10\",\n                            \"lessThanOrEqual\": \"7.0.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.1\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/239cec25a22662dbd80f57d94b38178c8be95269","https://git.kernel.org/stable/c/d0862de7c866c5bd7c32531f66738c21197af888","https://git.kernel.org/stable/c/43683bb280330f3d36f0f2a3932a4867b9603e9c","https://git.kernel.org/stable/c/d8e27d2d22b6e2df3a0125b8c08e9aace38c954c"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-53085","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-53085","identifiers":["CVE-2026-53085"]},"retained":false,"historicalAffected":[]}],"coverage":[]}