Linux Kernel EUVD-2026-38952

The BPF task_vma iterator in the Linux kernel previously held the per-VMA (Virtual Memory Area) lock throughout the BPF program body's execution. BPF helper functions invoked within that program body may internally acquire mmap_lock (e.g., via i_rwsem for file operations), creating a circular lock dependency chain: vm_lock → i_rwsem → mmap_lock → vm_lock. This is a classic lock inversion problem capable of producing a system deadlock. The upstream fix snapshots the VMA structure via memcpy() under the per-VMA lock in the _next() function, then drops the lock before yielding control to the BPF program - ensuring the program only accesses a safe, unlocked snapshot. vm_file is reference-counted with get_file() under the lock and released via fput() on the next iteration or at iterator destruction; vm_mm safety is guaranteed because lock_vma_under_rcu() verifies vma->vm_mm == mm before the snapshot. The affected CPE is cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*, indicating all Linux kernel builds from the introducing commit onward. No CWE is formally assigned, but this aligns with CWE-667 (Improper Locking) due to unsafe lock ordering across subsystem boundaries.