CVE-2026-93137 (GCVE-0-2026-93137)

Vulnerability from cvelistv5 – Published: 2026-09-17 16:11 – Updated: 2026-09-18 17:56
VLAI
Title
bpf: Fix use-after-free on mm_struct in bpf_find_vma()
Summary
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix use-after-free on mm_struct in bpf_find_vma() bpf_find_vma() reads task->mm and calls mmap_read_trylock(mm) without holding a reference on the mm. On a foreign task, a concurrent exit_mm() can free the mm_struct between the lockless read and the trylock, resulting in a use-after-free. mm_struct is not SLAB_TYPESAFE_BY_RCU. For the current task, task->mm is stable. For a foreign task, pin the mm under task->alloc_lock and release it with mmput_async(), mirroring commit d8e27d2d22b6 ("bpf: fix mm lifecycle in open-coded task_vma iterator"). Use spin_trylock() instead of get_task_mm() so BPF context does not block on alloc_lock. Reject irqs-disabled contexts and !CONFIG_MMU on the foreign-task path because dropping the mm reference is not safe there. Race: CPU0 (BPF program) CPU1 (exiting task) ============================ ========================== bpf_find_vma(foreign_task): mm = task->mm exit_mm(): task->mm = NULL mmput(mm) -> frees mm_struct mmap_read_trylock(mm) // UAF on mm
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 7c7e3d31e7856a8260a254f8c71db416f7f9f5a1 , < db347840d6b6ee9bb9b8e4a985d4b4419f9f3200 (git)
Affected: 7c7e3d31e7856a8260a254f8c71db416f7f9f5a1 , < 8e1101fc4118019a69c96ced4aec93164f89cbd5 (git)
Affected: 7c7e3d31e7856a8260a254f8c71db416f7f9f5a1 , < c7ad910e987008e125eeff448892e86852173384 (git)
Affected: 7c7e3d31e7856a8260a254f8c71db416f7f9f5a1 , < 86d54cf069fc5ae2e111c87933bebf6eb527978e (git)
Affected: 7c7e3d31e7856a8260a254f8c71db416f7f9f5a1 , < 2b2a903bee56d312539046d9defa8023eec94760 (git)
Affected: 7c7e3d31e7856a8260a254f8c71db416f7f9f5a1 , < 47b079e2117a2ee52e21f8b72935900c702fc0b5 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.17
Unaffected: 0 , < 5.17 (semver)
Unaffected: 6.1.188 , ≤ 6.1.* (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.110 , ≤ 6.12.* (semver)
Unaffected: 6.18.52 , ≤ 6.18.* (semver)
Unaffected: 7.2.6 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/task_iter.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "db347840d6b6ee9bb9b8e4a985d4b4419f9f3200",
              "status": "affected",
              "version": "7c7e3d31e7856a8260a254f8c71db416f7f9f5a1",
              "versionType": "git"
            },
            {
              "lessThan": "8e1101fc4118019a69c96ced4aec93164f89cbd5",
              "status": "affected",
              "version": "7c7e3d31e7856a8260a254f8c71db416f7f9f5a1",
              "versionType": "git"
            },
            {
              "lessThan": "c7ad910e987008e125eeff448892e86852173384",
              "status": "affected",
              "version": "7c7e3d31e7856a8260a254f8c71db416f7f9f5a1",
              "versionType": "git"
            },
            {
              "lessThan": "86d54cf069fc5ae2e111c87933bebf6eb527978e",
              "status": "affected",
              "version": "7c7e3d31e7856a8260a254f8c71db416f7f9f5a1",
              "versionType": "git"
            },
            {
              "lessThan": "2b2a903bee56d312539046d9defa8023eec94760",
              "status": "affected",
              "version": "7c7e3d31e7856a8260a254f8c71db416f7f9f5a1",
              "versionType": "git"
            },
            {
              "lessThan": "47b079e2117a2ee52e21f8b72935900c702fc0b5",
              "status": "affected",
              "version": "7c7e3d31e7856a8260a254f8c71db416f7f9f5a1",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/task_iter.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.17"
            },
            {
              "lessThan": "5.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.110",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.52",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.6",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix use-after-free on mm_struct in bpf_find_vma()\n\nbpf_find_vma() reads task-\u003emm and calls mmap_read_trylock(mm) without\nholding a reference on the mm. On a foreign task, a concurrent exit_mm()\ncan free the mm_struct between the lockless read and the trylock,\nresulting in a use-after-free. mm_struct is not SLAB_TYPESAFE_BY_RCU.\n\nFor the current task, task-\u003emm is stable. For a foreign task, pin the mm\nunder task-\u003ealloc_lock and release it with mmput_async(), mirroring commit\nd8e27d2d22b6 (\"bpf: fix mm lifecycle in open-coded task_vma iterator\").\nUse spin_trylock() instead of get_task_mm() so BPF context does not block\non alloc_lock. Reject irqs-disabled contexts and !CONFIG_MMU on the\nforeign-task path because dropping the mm reference is not safe there.\n\nRace:\n\n  CPU0 (BPF program)                  CPU1 (exiting task)\n  ============================        ==========================\n  bpf_find_vma(foreign_task):\n    mm = task-\u003emm\n                                      exit_mm():\n                                        task-\u003emm = NULL\n                                        mmput(mm) -\u003e frees mm_struct\n    mmap_read_trylock(mm)\n        // UAF on mm"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - bpf_find_vma() is invoked only from a program loaded via bpf(BPF_PROG_LOAD): BPF_PROG_TYPE_SYSCALL (syscall_prog_func_proto) or tracing/raw_tp (bpf_tracing_func_proto), both reaching bpf_base_func_proto() for BPF_FUNC_find_vma. The stale mm comes from bpf_task_from_pid() or a tracing task argument, not from a remote protocol field.\nAC:L - The race is inside bpf_find_vma() between the lockless task-\u003emm load and mmap_read_trylock(mm). The attacker forks a child, looks it up with bpf_task_from_pid(), and hammers BPF_PROG_RUN (or an attached raw_tp) while that child exits so exit_mm()\u2192mmput() frees the mm; they control both sides.\nPR:L - bpf_base_func_proto() returns bpf_find_vma_proto only after bpf_token_capable(CAP_PERFMON); bpf_prog_load() also needs CAP_BPF, and RAW_TRACEPOINT/TRACING fail is_perfmon_prog_type() without CAP_PERFMON. bpf_token_capable() uses ns_capable() on a delegated token\u0027s userns, so this is not init-namespace root.\nUI:N - The attacker loads the program with BPF_PROG_LOAD, runs it via BPF_PROG_RUN or their own attached probe, and exits their own child so exit_mm() races bpf_find_vma(); no other user must mount a filesystem or open a file.\nS:U - mmap_read_trylock() and find_vma() operate on the host kernel mm_struct that bpf_find_vma() cached from task-\u003emm. That is in-kernel memory corruption in the same authority as the bpf() caller, not a KVM/Xen guest-to-host or IOMMU escape.\nC:H - After exit_mm() mmput() frees the mm_struct (mm_cachep is not SLAB_TYPESAFE_BY_RCU), bpf_find_vma() still calls find_vma(mm, start) and hands the resulting vm_area_struct to the BPF callback, so the program can read reallocated kernel VMA/mm memory.\nI:H - The stale mm is used by mmap_read_trylock() (down_read_trylock on mm-\u003emmap_lock) and bpf_mmap_unlock_mm(); those write a freed mm_struct, and find_vma() may walk a reallocated maple tree, which is UAF corruption exploitable for an arbitrary kernel write.\nA:H - down_read_trylock on a freed mm-\u003emmap_lock or find_vma() walking a freed mm-\u003emm_mt oopses or panics the kernel, and the attacker can repeat bpf_find_vma() against children they exit."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T17:56:08.618Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/db347840d6b6ee9bb9b8e4a985d4b4419f9f3200"
        },
        {
          "url": "https://git.kernel.org/stable/c/8e1101fc4118019a69c96ced4aec93164f89cbd5"
        },
        {
          "url": "https://git.kernel.org/stable/c/c7ad910e987008e125eeff448892e86852173384"
        },
        {
          "url": "https://git.kernel.org/stable/c/86d54cf069fc5ae2e111c87933bebf6eb527978e"
        },
        {
          "url": "https://git.kernel.org/stable/c/2b2a903bee56d312539046d9defa8023eec94760"
        },
        {
          "url": "https://git.kernel.org/stable/c/47b079e2117a2ee52e21f8b72935900c702fc0b5"
        }
      ],
      "title": "bpf: Fix use-after-free on mm_struct in bpf_find_vma()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-93137",
    "datePublished": "2026-09-17T16:11:38.135Z",
    "dateReserved": "2026-09-17T16:02:15.088Z",
    "dateUpdated": "2026-09-18T17:56:08.618Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-93137",
      "date": "2026-09-29",
      "epss": "0.00171",
      "percentile": "0.05767"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-23T02:23:41.000Z",
      "cve": "CVE-2026-93137",
      "id": "msrc_CVE-2026-93137",
      "initial_release_date": "2026-09-19T01:18:27.000Z",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "bpf: Fix use-after-free on mm_struct in bpf_find_vma()",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-93137.json",
      "version": "2"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "kernel/bpf/task_iter.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "db347840d6b6ee9bb9b8e4a985d4b4419f9f3200",
                    "status": "affected",
                    "version": "7c7e3d31e7856a8260a254f8c71db416f7f9f5a1",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "8e1101fc4118019a69c96ced4aec93164f89cbd5",
                    "status": "affected",
                    "version": "7c7e3d31e7856a8260a254f8c71db416f7f9f5a1",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "c7ad910e987008e125eeff448892e86852173384",
                    "status": "affected",
                    "version": "7c7e3d31e7856a8260a254f8c71db416f7f9f5a1",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "86d54cf069fc5ae2e111c87933bebf6eb527978e",
                    "status": "affected",
                    "version": "7c7e3d31e7856a8260a254f8c71db416f7f9f5a1",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2b2a903bee56d312539046d9defa8023eec94760",
                    "status": "affected",
                    "version": "7c7e3d31e7856a8260a254f8c71db416f7f9f5a1",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "47b079e2117a2ee52e21f8b72935900c702fc0b5",
                    "status": "affected",
                    "version": "7c7e3d31e7856a8260a254f8c71db416f7f9f5a1",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "kernel/bpf/task_iter.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.17"
                  },
                  {
                    "lessThan": "5.17",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.188",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.157",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.110",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.52",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix use-after-free on mm_struct in bpf_find_vma()\n\nbpf_find_vma() reads task-\u003emm and calls mmap_read_trylock(mm) without\nholding a reference on the mm. On a foreign task, a concurrent exit_mm()\ncan free the mm_struct between the lockless read and the trylock,\nresulting in a use-after-free. mm_struct is not SLAB_TYPESAFE_BY_RCU.\n\nFor the current task, task-\u003emm is stable. For a foreign task, pin the mm\nunder task-\u003ealloc_lock and release it with mmput_async(), mirroring commit\nd8e27d2d22b6 (\"bpf: fix mm lifecycle in open-coded task_vma iterator\").\nUse spin_trylock() instead of get_task_mm() so BPF context does not block\non alloc_lock. Reject irqs-disabled contexts and !CONFIG_MMU on the\nforeign-task path because dropping the mm reference is not safe there.\n\nRace:\n\n  CPU0 (BPF program)                  CPU1 (exiting task)\n  ============================        ==========================\n  bpf_find_vma(foreign_task):\n    mm = task-\u003emm\n                                      exit_mm():\n                                        task-\u003emm = NULL\n                                        mmput(mm) -\u003e frees mm_struct\n    mmap_read_trylock(mm)\n        // UAF on mm"
          }
        ],
        "id": "CVE-2026-93137",
        "lastModified": "2026-09-18T18:18:22.207",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-17T17:18:08.600",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/2b2a903bee56d312539046d9defa8023eec94760"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/47b079e2117a2ee52e21f8b72935900c702fc0b5"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/86d54cf069fc5ae2e111c87933bebf6eb527978e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/8e1101fc4118019a69c96ced4aec93164f89cbd5"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/c7ad910e987008e125eeff448892e86852173384"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/db347840d6b6ee9bb9b8e4a985d4b4419f9f3200"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-22T16:24:19Z",
      "cve": "CVE-2026-93137",
      "id": "CVE-2026-93137",
      "initial_release_date": "2026-09-18T00:11:43Z",
      "product_status:known_affected": "162",
      "product_status:known_not_affected": "185",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-93137",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-93137.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.