Linux kernel BPF task_vma iterator: mm_struct used without a reference, freed under the iterator

Impact

The open-coded task_vma iterator read task->mm locklessly and took mmap_read_trylock() but never called mmget(). If the target task exits during iteration the mm_struct is freed - it is not SLAB_TYPESAFE_BY_RCU - and the iterator keeps using it, a use-after-free on a core memory-management structure. task_vma iteration is what profilers and continuous-profiling agents do constantly on busy GPU nodes, and short-lived training and inference processes exiting mid-scan is the normal state of such a node, not an edge case. The fix takes a real mm reference via a trylock on alloc_lock, releases it with mmput_async(), and additionally rejects irqs-disabled and NMI contexts, since the unlock and mmput paths take spinlocks and could otherwise deadlock from a tracepoint.

Who can reach it

Local. Requires loading a BPF program using the open-coded task_vma iterator - CAP_BPF/CAP_SYS_ADMIN, so profiling and observability agents. Triggering it needs a task to exit concurrently, which is trivially arranged on a shared node.

What to do

Update to a fixed stable or distribution kernel and reboot. Red Hat tracks it for RHEL 6 through 10. If you run a continuous profiler that walks task VMAs, that agent is the thing provoking this, so until the kernel is patched the lowest-cost reduction is pausing or scoping that profiler rather than leaving it sweeping every exiting process.

References

Related entries

• Linux BPF offload: refcount increment on a dying netns causes use-after-free during info queryCVE-2026-53089 · Linux kernel BPF offload (bpf_map/prog_offload_info_fill_ns netns refcount)High
• Linux kernel BPF verifier: ld_abs/ld_ind failure path left unverified inside subprogramsCVE-2026-53090 · Linux kernel BPF verifier (ld_abs/ld_ind in subprograms)High
• Linux kernel BPF verifier: mis-tracked rX += rX delta lets a program diverge from its verified boundsCVE-2026-53092 · Linux kernel BPF verifier (linked-register delta tracking in adjust_reg_min_max_vals())High
• Linux kernel BPF offload: dev-bound program freed while offload->prog still points at itCVE-2026-53094 · Linux kernel BPF offload (stale offload->prog after bpf_jit_blind_constants)High
• Linux bpf devmap: non-RCU hash iteration in the XDP broadcast redirect path can read a half-built entryCVE-2026-53096 · Linux kernel bpf devmap (dev_map_redirect_multi, DEVMAP_HASH SKB path)High
• Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): An out-of-bounds access in the amdkfd (KFD computeCVE-2026-53143 · Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd)High