Linux Kernel CVE-2026-53085

The flaw lives in the eBPF task_vma open-coded iterator (bpf_iter_task_vma_*), used by BPF programs to walk a task's memory mappings (struct vm_area_struct) via its mm_struct. Correct kernel idiom requires pinning an mm with mmget()/get_task_mm() before traversal, but the iterator only performed mmap_read_trylock(), leaving a window where a concurrently exiting task could free mm_struct. Because mm_struct is not allocated with SLAB_TYPESAFE_BY_RCU, the freed object can be reused, making the dangling reference a classic use-after-free (CWE-416), even though the CVE feed lists CWE as N/A. The remediation reads task->mm under a trylock on alloc_lock (rather than the blocking task_lock()/get_task_mm path, which would deadlock if a softirq BPF program iterates a task holding its own alloc_lock on the same CPU), takes a proper mm reference, and releases it via a bpf_iter_mmput_async() wrapper in the _destroy() and error paths. It also rejects IRQs-disabled and NMI contexts up front, since mmap_read_unlock and mmput_async take spinlocks (pool->lock, pi_lock) that could deadlock from NMI or a tracepoint firing with those locks held.