---
id: CVE-2026-53084
title: 'bpf: return VMA snapshot from task_vma iterator'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  bpf: return VMA snapshot from task_vma iterator

  Holding the per-VMA lock across the BPF program body creates a lock
  ordering problem when helpers acquire locks that de…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 4ac4546821584736798aaa9e97da9f6eaf689ea3 <
    83b8802c034e843b83a3e1ef6f30cdd4e9ec291c
  - >-
    Linux >= 4ac4546821584736798aaa9e97da9f6eaf689ea3 <
    592226d138378601ae28eb890e2bbc23ec3600f7
  - >-
    Linux >= 4ac4546821584736798aaa9e97da9f6eaf689ea3 <
    13860ca37b8df0b856ee1ce3bdbd7c327d5f53e8
  - >-
    Linux >= 4ac4546821584736798aaa9e97da9f6eaf689ea3 <
    4cbee026db54cad39c39db4d356100cb133412b3
  - Linux 6.7
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T16:18:07.826476Z'
published: '2026-06-24'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T16:23:58.851Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-53084'
references:
  - url: 'https://git.kernel.org/stable/c/83b8802c034e843b83a3e1ef6f30cdd4e9ec291c'
  - url: 'https://git.kernel.org/stable/c/592226d138378601ae28eb890e2bbc23ec3600f7'
  - url: 'https://git.kernel.org/stable/c/13860ca37b8df0b856ee1ce3bdbd7c327d5f53e8'
  - url: 'https://git.kernel.org/stable/c/4cbee026db54cad39c39db4d356100cb133412b3'
tags:
  - cve.org
epss: 0.00162
epssPercentile: 0.05381
ingestedAt: '2026-11-06T16:57:43.299Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

bpf: return VMA snapshot from task_vma iterator

Holding the per-VMA lock across the BPF program body creates a lock
ordering problem when helpers acquire locks that depend on mmap_lock:

  vm_lock -> i_rwsem -> mmap_lock -> vm_lock

Snapshot the VMA under the per-VMA lock in _next() via memcpy(), then
drop the lock before returning. The BPF program accesses only the
snapshot.

The verifier only trusts vm_mm and vm_file pointers (see
BTF_TYPE_SAFE_TRUSTED_OR_NULL in verifier.c). vm_file is reference-
counted with get_file() under the lock and released via fput() on the
next iteration or in _destroy(). vm_mm is already correct because
lock_vma_under_rcu() verifies vma->vm_mm == mm. All other pointers
are left as-is by memcpy() since the verifier treats them as untrusted.

## Affected

- `Linux >= 4ac4546821584736798aaa9e97da9f6eaf689ea3 < 83b8802c034e843b83a3e1ef6f30cdd4e9ec291c`
- `Linux >= 4ac4546821584736798aaa9e97da9f6eaf689ea3 < 592226d138378601ae28eb890e2bbc23ec3600f7`
- `Linux >= 4ac4546821584736798aaa9e97da9f6eaf689ea3 < 13860ca37b8df0b856ee1ce3bdbd7c327d5f53e8`
- `Linux >= 4ac4546821584736798aaa9e97da9f6eaf689ea3 < 4cbee026db54cad39c39db4d356100cb133412b3`
- `Linux 6.7`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.