CVE-2026-93137 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix use-after-free on mm_struct in bpf_find_vma()
bpf_find_vma() reads task->mm and calls mmap_read_trylock(mm) without holding a reference on the mm. On a foreign task, a concurrent exit_mm() can free the mm_struct between the lockless read and the trylock, resulting in a use-after-free. mm_struct is not SLAB_TYPESAFE_BY_RCU.
For the current task, task->mm is stable. For a foreign task, pin the mm under task->alloc_lock and release it with mmput_async(), mirroring commit d8e27d2d22b6 ("bpf: fix mm lifecycle in open-coded task_vma iterator"). Use spin_trylock() instead of get_task_mm() so BPF context does not block on alloc_lock. Reject irqs-disabled contexts and !CONFIG_MMU on the foreign-task path because dropping the mm reference is not safe there.
Race:
CPU0 (BPF program) CPU1 (exiting task) ============================ ========================== bpf_find_vma(foreign_task): mm = task->mm exit_mm(): task->mm = NULL mmput(mm) -> frees mm_struct mmap_read_trylock(mm) // UAF on mm
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/17/2026
The Linux kernel BPF subsystem contained a critical use-after-free vulnerability within the bpf_find_vma function, stemming from improper handling of memory management structures during foreign task inspection. The core technical flaw lies in the sequence where the code reads the task pointer to its associated memory descriptor and subsequently attempts to acquire a read lock on that structure without first establishing a stable reference count. In scenarios involving a current or local task, this operation is generally safe because the task's lifecycle ensures stability of the mm_struct during execution. However, when operating on a foreign task—meaning a process other than the one currently executing the BPF program—the situation changes drastically. A concurrent exit_mm call by that foreign task can nullify its memory pointer and free the underlying mm_struct object between the initial lockless read and the subsequent attempt to acquire the mmap_read_trylock, leading directly to a use-after-free condition where kernel code accesses freed memory.
This vulnerability is categorized under CWE-416, which defines Use After Free errors, as it involves accessing an object after its memory has been released by another thread of execution. The operational impact of this flaw can be severe, potentially allowing for arbitrary code execution if the attacker can control the contents of the freed memory region or cause a kernel panic through invalid pointer dereference. Because mm_struct is not SLAB_TYPESAFE_BY_RCU, standard RCU read-side critical sections cannot safely protect against concurrent freeing without additional reference counting mechanisms. The race condition specifically exploits the window where task->mm has been set to NULL and the mmput function has triggered the deallocation of the structure before bpf_find_vma attempts to lock it for inspection.
The resolution implemented in this fix introduces rigorous lifecycle management for memory descriptors when dealing with foreign tasks. Instead of relying on a simple pointer read, the code now pins the mm_struct under task->alloc_lock to ensure its stability during access. This approach mirrors previous fixes applied to open-coded task_vma iterators and ensures that the reference count is properly managed throughout the operation. To prevent blocking BPF execution contexts which must remain non-blocking, the implementation utilizes spin_trylock rather than get_task_mm, allowing the program to fail gracefully if the lock cannot be acquired immediately without causing deadlocks or excessive latency in critical kernel paths.
Furthermore, additional safety constraints were applied to mitigate risks associated with specific execution environments. The fix explicitly rejects interrupts-disabled contexts and configurations lacking MMU support on the foreign-task path because dropping the mm reference is not safe under those conditions. This ensures that the complex synchronization logic required for proper lifecycle management does not introduce instability in edge cases where standard memory management assumptions do not hold. By enforcing these restrictions, the kernel maintains integrity even when BPF programs attempt to inspect tasks with unusual scheduling or hardware configurations.
From a threat modeling perspective, this vulnerability aligns with ATT&CK techniques related to privilege escalation and defense evasion through exploitation of kernel-level race conditions. Attackers leveraging such flaws can potentially bypass security controls that rely on accurate process memory inspection by triggering crashes or manipulating kernel state via the use-after-free condition. Mitigation strategies involve applying the latest kernel patches that include this fix, ensuring that BPF programs are audited for proper handling of foreign task references, and restricting BPF program permissions to minimize exposure to race conditions involving sensitive system structures like mm_struct. Regular updates to the Linux kernel are essential as they incorporate these synchronization fixes which close the window between pointer dereference and lock acquisition.