CVE-2026-53084: Linux Kernel Privilege Escalation Flaw

CVE-2026-53084 Overview

CVE-2026-53084 is a Linux kernel vulnerability in the Berkeley Packet Filter (BPF) subsystem. The flaw exists in the task_vma iterator, which previously held the per-Virtual Memory Area (VMA) lock across the BPF program body. This locking pattern created a lock ordering problem when BPF helpers acquired locks dependent on mmap_lock, producing the cycle vm_lock -> i_rwsem -> mmap_lock -> vm_lock. The kernel maintainers resolved the issue by snapshotting the VMA via memcpy() under the per-VMA lock in _next(), then dropping the lock before returning control to the BPF program.

Critical Impact
The lock ordering inversion could trigger deadlocks in the kernel when BPF programs using the task_vma iterator invoked helpers that depend on mmap_lock, leading to potential denial of service conditions.

Affected Products

Linux kernel branches containing the BPF task_vma iterator implementation
Distributions shipping affected upstream kernel versions prior to the referenced stable patch commits
Systems running BPF workloads that iterate process VMAs via the task_vma iterator

Discovery Timeline

2026-06-24 - CVE-2026-53084 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-53084

Vulnerability Analysis

The vulnerability resides in the BPF task_vma iterator, a kernel facility that allows BPF programs to walk a task's virtual memory areas. The original implementation held the per-VMA lock (vm_lock) for the entire duration of the BPF program invocation. BPF programs can call helpers that internally acquire other kernel locks, including the inode reader-writer semaphore (i_rwsem) and mmap_lock. This produces a circular lock dependency: vm_lock -> i_rwsem -> mmap_lock -> vm_lock, which the kernel's lockdep validator flags as a deadlock risk.

The fix changes the iterator contract. Inside _next(), the kernel now takes the per-VMA lock, copies the VMA structure into a stable snapshot using memcpy(), and releases the lock before invoking the BPF program. The BPF program then operates only on the snapshot.

Root Cause

The root cause is an improper lock ordering [CWE-667] in the BPF task_vma iterator. Holding vm_lock across arbitrary BPF code allowed helpers reaching back through the filesystem and memory subsystems to acquire locks that another path acquires before vm_lock, completing a deadlock cycle.

Attack Vector

Exploitation requires the ability to load and run BPF programs that use the task_vma iterator and call helpers acquiring i_rwsem or mmap_lock. Successful triggering of the lock cycle results in a kernel deadlock or lockdep splat, producing denial of service. The verifier only trusts the vm_mm and vm_file pointers in the snapshot. vm_file is reference-counted with get_file() under the lock and released via fput() on the next iteration or in _destroy(). vm_mm remains valid because lock_vma_under_rcu() verifies vma->vm_mm == mm.

No verified public exploit code is available. See the upstream commits for the technical fix: Kernel Git Commit 592226d and Kernel Git Commit 13860ca.

Detection Methods for CVE-2026-53084

Indicators of Compromise

Kernel lockdep warnings referencing vm_lock, i_rwsem, and mmap_lock in the same dependency chain
Soft lockup or hung task messages emanating from processes invoking BPF iterators over /proc/<pid>/maps-equivalent data
Unexpected stalls in tooling that uses the task_vma iterator such as bpftool or custom BPF observability agents

Detection Strategies

Audit BPF program loads on production hosts and identify programs declaring the task_vma iterator type
Correlate kernel ring buffer messages (dmesg) with BPF program load events to surface lockdep reports tied to VMA iteration
Track the running kernel version against the upstream stable branches that received the fix commits referenced above

Monitoring Recommendations

Forward kernel logs and BPF subsystem audit events to a centralized analytics platform for correlation across the fleet
Monitor bpf() syscall activity, focusing on BPF_ITER_CREATE invocations targeting task_vma
Alert on repeated hung task warnings on hosts that run observability or security agents using BPF iterators

How to Mitigate CVE-2026-53084

Immediate Actions Required

Inventory kernel versions across Linux endpoints and servers and identify hosts running pre-patch kernels with BPF enabled
Apply the stable kernel updates that include the upstream fix commits as soon as vendor builds are available
Restrict CAP_BPF and CAP_SYS_ADMIN to trusted workloads, since loading BPF iterators requires these capabilities

Patch Information

The fix is available in the following upstream stable commits: Kernel Git Commit 592226d, Kernel Git Commit 13860ca, Kernel Git Commit 4cbee02, and Kernel Git Commit 83b8802. Rebuild and deploy distribution kernels that incorporate these commits, then reboot affected hosts to load the patched kernel image.

Workarounds

Disable or unload third-party BPF programs that use the task_vma iterator until the kernel patch is deployed
Limit unprivileged BPF by setting kernel.unprivileged_bpf_disabled=1 via sysctl to reduce the population of users who can load BPF programs
Restrict access to the bpf() syscall through seccomp profiles in containerized workloads where BPF iteration is not required

bash

# Configuration example: restrict unprivileged BPF and verify patched kernel
sudo sysctl -w kernel.unprivileged_bpf_disabled=1
echo 'kernel.unprivileged_bpf_disabled=1' | sudo tee /etc/sysctl.d/90-bpf-hardening.conf
uname -r