{"cve":"CVE-2026-93137","nvd":{"published":"2026-09-17T17:18:08.600","modified":"2026-10-19T10:17:03.707","status":"Received","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix use-after-free on mm_struct in bpf_find_vma()\n\nbpf_find_vma() reads task->mm and calls mmap_read_trylock(mm) without\nholding a reference on the mm. On a foreign task, a concurrent exit_mm()\ncan free the mm_struct between the lockless read and the trylock,\nresulting in a use-after-free. mm_struct is not SLAB_TYPESAFE_BY_RCU.\n\nFor the current task, task->mm is stable. For a foreign task, pin the mm\nunder task->alloc_lock and release it with mmput_async(), mirroring commit\nd8e27d2d22b6 (\"bpf: fix mm lifecycle in open-coded task_vma iterator\").\nUse spin_trylock() instead of get_task_mm() so BPF context does not block\non alloc_lock. Reject irqs-disabled contexts and !CONFIG_MMU on the\nforeign-task path because dropping the mm reference is not safe there.\n\nRace:\n\n  CPU0 (BPF program)                  CPU1 (exiting task)\n  ============================        ==========================\n  bpf_find_vma(foreign_task):\n    mm = task->mm\n                                      exit_mm():\n                                        task->mm = NULL\n                                        mmput(mm) -> frees mm_struct\n    mmap_read_trylock(mm)\n        // UAF on mm","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8},"cwes":[],"references":["https://git.kernel.org/stable/c/2b2a903bee56d312539046d9defa8023eec94760","https://git.kernel.org/stable/c/47b079e2117a2ee52e21f8b72935900c702fc0b5","https://git.kernel.org/stable/c/86d54cf069fc5ae2e111c87933bebf6eb527978e","https://git.kernel.org/stable/c/8e1101fc4118019a69c96ced4aec93164f89cbd5","https://git.kernel.org/stable/c/c7ad910e987008e125eeff448892e86852173384"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:55:23.253742848+00:00"},"epss":{"cve":"CVE-2026-93137","score":0.0016,"percentile":0.05064,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}