CVE-2026-53084 bpf: return VMA snapshot from task_vma iterator
A lock ordering issue in the Linux kernel BPF task_vma iterator can cause deadlocks, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-53084?
CVE-2026-53084 is a medium-severity vulnerability in Linux kernel, published on 24 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
bpf: return VMA snapshot from task_vma iterator
Holding the per-VMA lock across the BPF program body creates a lock ordering problem when helpers acquire locks that depend on mmap_lock:
vm_lock -> i_rwsem -> mmap_lock -> vm_lock
Snapshot the VMA under the per-VMA lock in _next() via memcpy(), then drop the lock before returning. The BPF program accesses only the snapshot.
The verifier only trusts vm_mm and vm_file pointers (see BTF_TYPE_SAFE_TRUSTED_OR_NULL in verifier.c). vm_file is reference- counted with get_file() under the lock and released via fput() on the next iteration or in _destroy(). vm_mm is already correct because lock_vma_under_rcu() verifies vma->vm_mm == mm. All other pointers are left as-is by memcpy() since the verifier treats them as untrusted.
Which versions are affected by CVE-2026-53084?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-53084?
Apply the vendor's patch.
Is CVE-2026-53084 being exploited?
There is no known exploitation of CVE-2026-53084 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-53084, DEBIAN-CVE-2026-53084, GHSA-cmp2-w8c6-7f92, ROOT-OS-UBUNTU-2404-CVE-2026-53084, UBUNTU-CVE-2026-53084.