Linux Kernel CVE-2026-93137

Requires local privilege to load and run a BPF program (CAP_BPF-class) that invokes bpf_find_vma() against a FOREIGN task - the current-task path is safe because task->mm is stable. Exploitation further requires winning a race: the foreign target must execute exit_mm() (freeing its mm_struct) precisely between the lockless task->mm read and the mmap_read_trylock() call. Limiting factors: needs CONFIG_MMU builds and non-irqs-disabled context on the foreign path (the fix rejects these), a tight timing window on a task the attacker must be able to reference, and BPF program load privileges typically unavailable to unprivileged users on hardened/locked-down kernels.

The vendor CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 7.8) overstates real-world risk for what is fundamentally a race-condition-driven use-after-free on a foreign task's mm_struct. The AC:L rating is questionable: exploitation requires winning a narrow TOCTOU window between the lockless read of task->mm and mmap_read_trylock() while a foreign task is concurrently executing exit_mm() - a genuine race, better modeled as AC:H. PR:L is appropriate because reaching bpf_find_vma() requires loading and running a BPF program (CAP_BPF-class privilege), which is not available to unprivileged users on hardened systems. The C:H/I:H/A:H triple is optimistic: a UAF on mm_struct most reliably yields a kernel crash (DoS), with information disclosure or corruption possible but far harder to weaponize. No EPSS score, no CISA KEV listing, and no public POC are provided; combined with the CAP_BPF gate and the tight race, real-world exploitation is unlikely and this is a high-CVSS-but-lower-real-risk issue. My independent assessment lands around 5.0-5.5. Note the input Tags label this 'Information Disclosure' which conflicts with the crash/DoS-primary nature of an mm_struct UAF.

A local user with CAP_BPF loads a BPF program that calls bpf_find_vma() against a foreign task (e.g., a task iterator or via a pid), then races the target through exit_mm() so the mm_struct is freed between the lockless task->mm read and mmap_read_trylock(). Winning the race dereferences freed memory, typically crashing the kernel. No public exploit code is identified at time of analysis.