CVE-2026-53085: Linux Kernel BPF task_vma Iterator Use-After-Free (CVSS 7.8)

Technical summary

The vulnerability resides in the BPF subsystem's open-coded task_vma iterator implementation. The code performs a lockless read of task->mm and attempts mmap_read_trylock() without incrementing the mm_struct reference count via mmget(). Since mm_struct is not protected by SLAB_TYPESAFE_BY_RCU, concurrent task exit can trigger free() while the iterator holds a pointer to the freed structure. The fix introduces safe mm_struct access by: (1) using trylock on alloc_lock to safely read task->mm, (2) acquiring a reference via mmget(), (3) releasing references via bpf_iter_mmput_async() in cleanup and error paths, and (4) rejecting execution from NMI and IRQ-disabled contexts to prevent deadlock scenarios where nested locks (pool->lock, pi_lock) could be held during BPF execution.

Business impact

Organizations relying on BPF-based monitoring, tracing, or security tools face potential kernel crashes or memory corruption. Exploitation could lead to denial of service through kernel panic, data corruption affecting workloads running on the same kernel instance, or potential privilege escalation if the use-after-free is chained with other techniques. Container orchestration platforms and observability stacks that deploy in-kernel BPF programs are particularly exposed. The impact severity depends on whether unprivileged BPF loading is enabled and the trust model for BPF program sources within the environment.

Affected systems

Linux systems running vulnerable kernel versions are affected. The vulnerability impacts any deployment using BPF-based tools for tracing, profiling, or security monitoring that rely on task_vma iteration. This includes systems with enabled BPF unprivileged user space loading, Kubernetes nodes running eBPF-based CNI or security agents, and observability platforms deploying kernel-space collectors. Systems where BPF program loading is restricted to privileged users face reduced but non-zero risk if those users or processes are compromised.

Exploitability

The vulnerability requires ability to load or execute BPF programs that use task_vma iteration. On systems with unprivileged BPF enabled (CAP_BPF or equivalent), local unprivileged users can exploit this. On restricted systems, exploitation requires CAP_BPF or equivalent privilege. The flawed code path is straightforward to trigger—any BPF program iterating task virtual memory regions can cause the use-after-free if task exit timing aligns unfavorably. No sophisticated exploitation technique is necessary; the vulnerability is inherent to the iterator design. However, triggering consistent exploitation requires timing control or repeated attempts to hit the race condition.

Remediation

Apply kernel patches that implement safe mm_struct lifecycle management in the task_vma iterator. The fix must include: (1) replacement of lockless mm_struct access with alloc_lock trylock, (2) mmget() to acquire reference on successful read, (3) bpf_iter_mmput_async() wrapper in cleanup paths, and (4) explicit rejection of IRQ-disabled and NMI contexts. Verify patches against the official Linux kernel security advisories and your distribution's kernel maintenance channel. Test patched kernels thoroughly in staging environments before production deployment to ensure BPF-dependent monitoring tools remain functional.

Patch guidance

Contact your Linux distribution vendor for patched kernel packages targeting this CVE. Upstream Linux kernel repositories will contain the formal fix. Patch availability timeline varies by distribution; enterprise vendors (Red Hat, Canonical, SUSE) typically backport to supported stable branches. Verify patch applicability to your specific kernel version series and confirm no conflicting patches or local modifications prevent clean application. Test BPF programs and kernel tracing tools after patching to validate functionality, particularly any custom or third-party eBPF monitoring solutions.

Detection guidance

Monitor kernel logs for use-after-free warnings, page faults, or BPF subsystem errors coinciding with BPF program execution and task exit events. Kernel Address Sanitizer (KASAN) builds will clearly flag use-after-free in mm_struct access. Correlate kernel crashes or unexpected terminations with BPF program activity and task lifecycle events. Inspect running BPF programs to identify any using task_vma iteration; these are direct candidates for exploitation if kernel is unpatched. Implement process accounting to track concurrent BPF iterator and task exit activity for forensic correlation.

Why prioritize this

HIGH severity (CVSS 7.8) stems from local privilege requirement, high impact on confidentiality/integrity/availability, and straightforward exploitability for privileged attackers. Systems with unprivileged BPF enabled face elevated risk. While KEV listing is not confirmed for this CVE, the use-after-free and associated denial-of-service risk justify rapid patching for production systems running BPF-dependent workloads. Prioritize systems where BPF tools are integral to observability, security posture, or network function.

Risk score, explained

CVSS 7.8 (HIGH) reflects: Local attack vector (AV:L) requiring user or process privilege to load BPF; Low complexity (AC:L) as the race condition is inherent and requires only standard BPF iterator usage; Requires CAP_BPF or unprivileged variant (PR:L); No user interaction needed (UI:N); Unchanged scope (S:U) as impact is confined to the affected kernel instance; but High confidentiality, integrity, and availability impact (C:H/I:H/A:H) through memory corruption and denial of service.

Frequently asked questions