CVE-2026-53085: Linux Kernel Use-After-Free Vulnerability

CVE-2026-53085 Overview

CVE-2026-53085 is a use-after-free vulnerability in the Linux kernel's BPF (Berkeley Packet Filter) subsystem. The flaw resides in the open-coded task_vma iterator, which reads task->mm locklessly and acquires mmap_read_trylock() without calling mmget(). If the target task exits concurrently, the mm_struct can be freed while still referenced, because it is not protected by SLAB_TYPESAFE_BY_RCU.

Critical Impact
A concurrent task exit during BPF iteration can free the mm_struct while the iterator still holds a reference, leading to a use-after-free condition in kernel memory.

Affected Products

Linux kernel versions implementing the open-coded task_vma BPF iterator
Distributions shipping affected stable kernel branches prior to the referenced fix commits
Systems with BPF programs that traverse task virtual memory areas

Discovery Timeline

2026-06-24 - CVE-2026-53085 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-53085

Vulnerability Analysis

The vulnerability exists in the BPF open-coded task_vma iterator implementation. The iterator reads the task->mm pointer without holding a lock and acquires mmap_read_trylock() to traverse virtual memory areas. It does not call mmget() to acquire a reference on the mm_struct.

When the iterated task exits concurrently on another CPU, the mm_struct may be released. Because mm_struct is not allocated with SLAB_TYPESAFE_BY_RCU, the memory can be returned to the slab allocator and reused while the BPF iterator still references it. This produces a classic use-after-free [CWE-416] in kernel context.

The fix introduces a trylock on alloc_lock to safely read task->mm and then acquires an explicit mm reference. The reference is released through bpf_iter_mmput_async(), a wrapper around mmput_async() with a fallback to mmput() on !CONFIG_MMU builds.

Root Cause

The root cause is a missing reference count acquisition on the mm_struct during BPF iteration. The original code assumed that holding mmap_read_trylock() was sufficient, but this lock does not prevent the mm_struct itself from being freed once the owning task exits and drops its final reference.

Attack Vector

Exploitation requires the ability to load and run BPF programs that use the open-coded task_vma iterator against a target task. The patch also rejects IRQ-disabled contexts (including NMI) up front, because operations in _next() and _destroy() take spinlocks such as pool->lock and pi_lock with IRQs disabled. Running from NMI or a tracepoint holding those locks could deadlock. The patch chooses a trylock on alloc_lock instead of the blocking task_lock() (used by get_task_mm) to avoid deadlock when a softirq BPF program iterates a task already holding its alloc_lock on the same CPU.

No public exploit code is available. Refer to the upstream commits for the precise fix implementation: Kernel Git Commit 239cec25, Kernel Git Commit 43683bb2, Kernel Git Commit d0862de7, and Kernel Git Commit d8e27d2d.

Detection Methods for CVE-2026-53085

Indicators of Compromise

Unexpected kernel oops or panic messages referencing task_vma iteration or mm_struct access
KASAN reports indicating use-after-free in BPF iterator code paths
Unprivileged or untrusted workloads loading BPF programs that invoke bpf_iter_task_vma primitives

Detection Strategies

Audit running kernel version against the fixed commit hashes in stable trees
Monitor bpf() syscall usage and BPF program loads that reference task or VMA iterators
Review eBPF program telemetry to identify programs traversing process memory maps

Monitoring Recommendations

Enable kernel KASAN in test environments to surface use-after-free conditions during BPF testing
Forward kernel logs to a centralized SIEM for correlation of crashes with BPF subsystem activity
Track which users and processes are permitted CAP_BPF or CAP_SYS_ADMIN capabilities

How to Mitigate CVE-2026-53085

Immediate Actions Required

Update affected Linux kernels to a version containing the upstream fix commits referenced above
Restrict the ability to load BPF programs to trusted users by tightening CAP_BPF and CAP_SYS_ADMIN assignment
Set kernel.unprivileged_bpf_disabled=1 on systems that do not require unprivileged BPF

Patch Information

The vulnerability is resolved by acquiring an explicit mm reference through a trylock on alloc_lock, releasing it via bpf_iter_mmput_async() in _destroy() and error paths, and rejecting IRQ-disabled contexts. Apply the patches from the stable kernel commits: 239cec25, 43683bb2, d0862de7, and d8e27d2d.

Workarounds

Disable unprivileged BPF program loading via sysctl kernel.unprivileged_bpf_disabled=1
Remove or restrict BPF capabilities from non-administrative service accounts
Avoid deploying BPF programs that use the open-coded task_vma iterator until kernels are patched

bash

# Configuration example
sysctl -w kernel.unprivileged_bpf_disabled=1
echo 'kernel.unprivileged_bpf_disabled=1' >> /etc/sysctl.d/99-bpf-hardening.conf