GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-93137 (GCVE-0-2026-93137)

Vulnerability from cvelistv5 – Published: 2026-09-17 16:11 – Updated: 2026-09-17 16:11
VLAI
Title
bpf: Fix use-after-free on mm_struct in bpf_find_vma()
Summary
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix use-after-free on mm_struct in bpf_find_vma() bpf_find_vma() reads task->mm and calls mmap_read_trylock(mm) without holding a reference on the mm. On a foreign task, a concurrent exit_mm() can free the mm_struct between the lockless read and the trylock, resulting in a use-after-free. mm_struct is not SLAB_TYPESAFE_BY_RCU. For the current task, task->mm is stable. For a foreign task, pin the mm under task->alloc_lock and release it with mmput_async(), mirroring commit d8e27d2d22b6 ("bpf: fix mm lifecycle in open-coded task_vma iterator"). Use spin_trylock() instead of get_task_mm() so BPF context does not block on alloc_lock. Reject irqs-disabled contexts and !CONFIG_MMU on the foreign-task path because dropping the mm reference is not safe there. Race: CPU0 (BPF program) CPU1 (exiting task) ============================ ========================== bpf_find_vma(foreign_task): mm = task->mm exit_mm(): task->mm = NULL mmput(mm) -> frees mm_struct mmap_read_trylock(mm) // UAF on mm
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 7c7e3d31e7856a8260a254f8c71db416f7f9f5a1 , < db347840d6b6ee9bb9b8e4a985d4b4419f9f3200 (git)
Affected: 7c7e3d31e7856a8260a254f8c71db416f7f9f5a1 , < 8e1101fc4118019a69c96ced4aec93164f89cbd5 (git)
Affected: 7c7e3d31e7856a8260a254f8c71db416f7f9f5a1 , < c7ad910e987008e125eeff448892e86852173384 (git)
Affected: 7c7e3d31e7856a8260a254f8c71db416f7f9f5a1 , < 86d54cf069fc5ae2e111c87933bebf6eb527978e (git)
Affected: 7c7e3d31e7856a8260a254f8c71db416f7f9f5a1 , < 2b2a903bee56d312539046d9defa8023eec94760 (git)
Affected: 7c7e3d31e7856a8260a254f8c71db416f7f9f5a1 , < 47b079e2117a2ee52e21f8b72935900c702fc0b5 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.17
Unaffected: 0 , < 5.17 (semver)
Unaffected: 6.1.188 , ≤ 6.1.* (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.110 , ≤ 6.12.* (semver)
Unaffected: 6.18.52 , ≤ 6.18.* (semver)
Unaffected: 7.2.6 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/task_iter.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "db347840d6b6ee9bb9b8e4a985d4b4419f9f3200",
              "status": "affected",
              "version": "7c7e3d31e7856a8260a254f8c71db416f7f9f5a1",
              "versionType": "git"
            },
            {
              "lessThan": "8e1101fc4118019a69c96ced4aec93164f89cbd5",
              "status": "affected",
              "version": "7c7e3d31e7856a8260a254f8c71db416f7f9f5a1",
              "versionType": "git"
            },
            {
              "lessThan": "c7ad910e987008e125eeff448892e86852173384",
              "status": "affected",
              "version": "7c7e3d31e7856a8260a254f8c71db416f7f9f5a1",
              "versionType": "git"
            },
            {
              "lessThan": "86d54cf069fc5ae2e111c87933bebf6eb527978e",
              "status": "affected",
              "version": "7c7e3d31e7856a8260a254f8c71db416f7f9f5a1",
              "versionType": "git"
            },
            {
              "lessThan": "2b2a903bee56d312539046d9defa8023eec94760",
              "status": "affected",
              "version": "7c7e3d31e7856a8260a254f8c71db416f7f9f5a1",
              "versionType": "git"
            },
            {
              "lessThan": "47b079e2117a2ee52e21f8b72935900c702fc0b5",
              "status": "affected",
              "version": "7c7e3d31e7856a8260a254f8c71db416f7f9f5a1",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/task_iter.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.17"
            },
            {
              "lessThan": "5.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.110",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.52",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.6",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix use-after-free on mm_struct in bpf_find_vma()\n\nbpf_find_vma() reads task-\u003emm and calls mmap_read_trylock(mm) without\nholding a reference on the mm. On a foreign task, a concurrent exit_mm()\ncan free the mm_struct between the lockless read and the trylock,\nresulting in a use-after-free. mm_struct is not SLAB_TYPESAFE_BY_RCU.\n\nFor the current task, task-\u003emm is stable. For a foreign task, pin the mm\nunder task-\u003ealloc_lock and release it with mmput_async(), mirroring commit\nd8e27d2d22b6 (\"bpf: fix mm lifecycle in open-coded task_vma iterator\").\nUse spin_trylock() instead of get_task_mm() so BPF context does not block\non alloc_lock. Reject irqs-disabled contexts and !CONFIG_MMU on the\nforeign-task path because dropping the mm reference is not safe there.\n\nRace:\n\n  CPU0 (BPF program)                  CPU1 (exiting task)\n  ============================        ==========================\n  bpf_find_vma(foreign_task):\n    mm = task-\u003emm\n                                      exit_mm():\n                                        task-\u003emm = NULL\n                                        mmput(mm) -\u003e frees mm_struct\n    mmap_read_trylock(mm)\n        // UAF on mm"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-17T16:11:38.135Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/db347840d6b6ee9bb9b8e4a985d4b4419f9f3200"
        },
        {
          "url": "https://git.kernel.org/stable/c/8e1101fc4118019a69c96ced4aec93164f89cbd5"
        },
        {
          "url": "https://git.kernel.org/stable/c/c7ad910e987008e125eeff448892e86852173384"
        },
        {
          "url": "https://git.kernel.org/stable/c/86d54cf069fc5ae2e111c87933bebf6eb527978e"
        },
        {
          "url": "https://git.kernel.org/stable/c/2b2a903bee56d312539046d9defa8023eec94760"
        },
        {
          "url": "https://git.kernel.org/stable/c/47b079e2117a2ee52e21f8b72935900c702fc0b5"
        }
      ],
      "title": "bpf: Fix use-after-free on mm_struct in bpf_find_vma()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-93137",
    "datePublished": "2026-09-17T16:11:38.135Z",
    "dateReserved": "2026-09-17T16:02:15.088Z",
    "dateUpdated": "2026-09-17T16:11:38.135Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-93137\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-17T17:18:08.600\",\"lastModified\":\"2026-09-17T17:18:08.600\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbpf: Fix use-after-free on mm_struct in bpf_find_vma()\\n\\nbpf_find_vma() reads task-\u003emm and calls mmap_read_trylock(mm) without\\nholding a reference on the mm. On a foreign task, a concurrent exit_mm()\\ncan free the mm_struct between the lockless read and the trylock,\\nresulting in a use-after-free. mm_struct is not SLAB_TYPESAFE_BY_RCU.\\n\\nFor the current task, task-\u003emm is stable. For a foreign task, pin the mm\\nunder task-\u003ealloc_lock and release it with mmput_async(), mirroring commit\\nd8e27d2d22b6 (\\\"bpf: fix mm lifecycle in open-coded task_vma iterator\\\").\\nUse spin_trylock() instead of get_task_mm() so BPF context does not block\\non alloc_lock. Reject irqs-disabled contexts and !CONFIG_MMU on the\\nforeign-task path because dropping the mm reference is not safe there.\\n\\nRace:\\n\\n  CPU0 (BPF program)                  CPU1 (exiting task)\\n  ============================        ==========================\\n  bpf_find_vma(foreign_task):\\n    mm = task-\u003emm\\n                                      exit_mm():\\n                                        task-\u003emm = NULL\\n                                        mmput(mm) -\u003e frees mm_struct\\n    mmap_read_trylock(mm)\\n        // UAF on mm\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"kernel/bpf/task_iter.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"7c7e3d31e7856a8260a254f8c71db416f7f9f5a1\",\"lessThan\":\"db347840d6b6ee9bb9b8e4a985d4b4419f9f3200\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7c7e3d31e7856a8260a254f8c71db416f7f9f5a1\",\"lessThan\":\"8e1101fc4118019a69c96ced4aec93164f89cbd5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7c7e3d31e7856a8260a254f8c71db416f7f9f5a1\",\"lessThan\":\"c7ad910e987008e125eeff448892e86852173384\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7c7e3d31e7856a8260a254f8c71db416f7f9f5a1\",\"lessThan\":\"86d54cf069fc5ae2e111c87933bebf6eb527978e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7c7e3d31e7856a8260a254f8c71db416f7f9f5a1\",\"lessThan\":\"2b2a903bee56d312539046d9defa8023eec94760\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7c7e3d31e7856a8260a254f8c71db416f7f9f5a1\",\"lessThan\":\"47b079e2117a2ee52e21f8b72935900c702fc0b5\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"kernel/bpf/task_iter.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.17\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.17\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.188\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.157\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.110\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.52\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2.6\",\"lessThanOrEqual\":\"7.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.3-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/2b2a903bee56d312539046d9defa8023eec94760\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/47b079e2117a2ee52e21f8b72935900c702fc0b5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/86d54cf069fc5ae2e111c87933bebf6eb527978e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/8e1101fc4118019a69c96ced4aec93164f89cbd5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c7ad910e987008e125eeff448892e86852173384\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/db347840d6b6ee9bb9b8e4a985d4b4419f9f3200\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.