PT-2026-51978 · Linux · Linux
Published
2026-06-24
·
Updated
2026-06-24
·
CVE-2026-53084
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
bpf: return VMA snapshot from task vma iterator
Holding the per-VMA lock across the BPF program body creates a lock
ordering problem when helpers acquire locks that depend on mmap lock:
vm lock -> i rwsem -> mmap lock -> vm lock
Snapshot the VMA under the per-VMA lock in next() via memcpy(), then
drop the lock before returning. The BPF program accesses only the
snapshot.
The verifier only trusts vm mm and vm file pointers (see
BTF TYPE SAFE TRUSTED OR NULL in verifier.c). vm file is reference-
counted with get file() under the lock and released via fput() on the
next iteration or in destroy(). vm mm is already correct because
lock vma under rcu() verifies vma->vm mm == mm. All other pointers
are left as-is by memcpy() since the verifier treats them as untrusted.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux