CVE-2026-53084
Description
In the Linux kernel, the following vulnerability has been resolved:
bpf: return VMA snapshot from task_vma iterator
Holding the per-VMA lock across the BPF program body creates a lock
ordering problem when helpers acquire locks that depend on mmap_lock:
vm_lock -> i_rwsem -> mmap_lock -> vm_lock
Snapshot the VMA under the per-VMA lock in _next() via memcpy(), then
drop the lock before returning. The BPF program accesses only the
snapshot.
The verifier only trusts vm_mm and vm_file pointers (see
BTF_TYPE_SAFE_TRUSTED_OR_NULL in verifier.c). vm_file is reference-
counted with get_file() under the lock and released via fput() on the
next iteration or in _destroy(). vm_mm is already correct because
lock_vma_under_rcu() verifies vma->vm_mm == mm. All other pointers
are left as-is by memcpy() since the verifier treats them as untrusted.
Summary dbcve.org
A lock ordering vulnerability exists in the Linux kernel's BPF task_vma iterator where holding the per-VMA lock across the entire BPF program body creates a problematic lock chain (vm_lock -> i_rwsem -> mmap_lock -> vm_lock). The fix modifies the _next() function to snapshot the VMA via memcpy() while holding the lock, then release the lock before the BPF program accesses the snapshot. The verifier only trusts vm_mm and vm_file pointers, with vm_file reference-counted under the lock.
Mitigation
This is a kernel-level vulnerability requiring a kernel patch. Organizations should apply Linux kernel updates that include this fix when available. There is no userspace-only workaround; systems running untrusted BPF programs are at greatest risk.