CVE-2026-53085
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
In the Linux kernel, the open-coded task_vma BPF iterator has a use-after-free (UAF) vulnerability. The iterator reads task->mm locklessly and does not call mmget(), allowing the mm_struct to be freed during concurrent process exit.
Risk Assessment
An attacker could exploit this vulnerability to escalate privileges or execute arbitrary code in kernel context, leading to full system compromise.
Recommendation
Apply the latest Linux kernel patch that adds safe reading of task->mm with alloc_lock and proper mm reference management.
Other vulnerabilities in Linux kernel
See all- CVE-2026-99284Unknown
In the Linux kernel, a vulnerability was resolved in the skb_zerocopy() function of the skbuff networking subsystem. The function does not propagate the shared-frag marker to the destination skb, breaking the invariant relied on by later in-place writers. As a result, an unprivileged user can write into the page cache of a root-owned read-only file.
- CVE-2026-99283Unknown
A bug in the Linux kernel netfilter conntrack TCP timeout selection was found. When an RST packet does not exactly match the expected sequence number, the conntrack entry remains ESTABLISHED, but the short CLOSE timeout (10 seconds) is still applied. A second non-exact RST can lower the timeout before the challenge ACK rate limit expires, allowing the conntrack entry to expire while both TCP endpoints remain established.
- CVE-2026-99282Unknown
In the Linux kernel, net/sched: sch_teql contains a use-after-free vulnerability. teql_master_xmit() incorrectly treats NET_XMIT_DROP as an unconsumed packet and operates on freed memory. The issue affects configurations with VLAN interfaces and pfifo qdisc with limit 0.
- CVE-2026-99281Unknown
A flaw in the Linux kernel tun/tap mechanism allowed processes without CAP_NET_ADMIN to attach to persistent tun devices that had no owner or group set. Anyone able to open /dev/net/tun could attach to such devices and intercept or inject network traffic. The fix now requires CAP_NET_ADMIN to attach to an ownerless, groupless device.
- CVE-2026-99280Unknown
In the Linux kernel, the following vulnerability has been resolved: ksmbd: drain session procfs readers before dropping table references. Session registration failure and connection cleanup can drop the table reference while the per-session procfs entry is still accessible. If a reader holds the last remaining reference, its final put calls proc_remove() from its own callback and waits for that callback to finish. Remove the procfs entry before dropping the table reference in the registration failure path. Queue sessions removed during connection cleanup and drain their procfs readers after releasing both session locks, then return their table references. Keep the global hash node unhashed while a session is queued so a concurrent unregister cannot drop the reference again. Previous-session replacement also destroys the file table before the session is finally freed. Detach the idr under the lock used by procfs file counters, and report zero files after it has been detached. This prevents a reader from accessing the idr during or after its destruction.
- CVE-2026-99278Unknown
In the Linux kernel, the following vulnerability has been resolved: ksmbd: limit sessions on each connection. The pending setup limit only counts InProgress sessions. A client can complete authentication repeatedly and retain an unbounded number of Valid sessions on one connection. Reserve a connection slot before allocating a session and retain a connection reference while authentication is in progress. The first SMB3 channel takes over that reservation; binding to another connection reserves one slot there. Reauthentication and authentication continuation reuse the existing reservation. Return slots on allocation or insertion failure, channel removal, and final session destruction. Accept max_sessions_per_connection in reserved startup-request space and default to 64 when older tools leave it zero. Keep the request size and existing field offsets unchanged. Expose the configured limit in procfs. The existing connection limits bound the aggregate number of sessions without a separate global session allocation limit.
- CVE-2026-99259Unknown
In the Linux kernel, the soc/tegra: pmc driver has an uninitialised early_pmc->rate variable for legacy 32-bit Tegra devices. The variable is never configured and remains 0, triggering a warning in tegra_pmc_enter_suspend_mode(). The issue appeared after the PMC driver was changed to create the PMC context dynamically, updating rate only in the new context.
- CVE-2026-99258Unknown
In the Linux kernel, hv_apicid_to_vp_index() uses per-CPU hypercall input and output pages. In an SEV-SNP CoCo VM without a paravisor the output page is not allocated, so the hypervisor stores the resulting VP index into memory not allocated by the guest. The fix uses the input page for both input and output.
- CVE-2026-99257Unknown
In the Linux kernel, the shared GPIO mechanism based on platform lookup tables requires an associated struct device. An fwnode-based lookup with no associated device currently causes a NULL-pointer dereference. The fix adds a check that lets the kernel gracefully handle this situation with an error.
- CVE-2026-99256Unknown
In the Linux kernel, the dm cache module used a rw_semaphore for background_work_lock, although write locks on rw_semaphores have strict owner semantics. The locking process was not always the same as the unlocking one, triggering a warning with CONFIG_DEBUG_RWSEMS during suspend/resume of a cache device. The fix replaces the rw_semaphore with a spinlock and a wait queue.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: bpf: fix mm lifecycle in open-coded task_vma iterator The open-coded task_vma iterator reads task->mm locklessly and acquires mmap_read_trylock() but never calls mmget(). If the task exits concurrently, the mm_struct can be freed as it is not SLAB_TYPESAFE_BY_RCU, resulting in a use-after-free. Safely read task->mm with a trylock on alloc_lock and acquire an mm reference. Drop the reference via bpf_iter_mmput_async() in _destroy() and error paths. bpf_iter_mmput_async() is a local wrapper around mmput_async() with a fallback to mmput() on !CONFIG_MMU. Reject irqs-disabled contexts (including NMI) up front. Operations used by _next() and _destroy() (mmap_read_unlock, bpf_iter_mmput_async) take spinlocks with IRQs disabled (pool->lock, pi_lock). Running from NMI or from a tracepoint that fires with those locks held could deadlock. A trylock on alloc_lock is used instead of the blocking task_lock() (get_task_mm) to avoid a deadlock when a softirq BPF program iterates a task that already holds its alloc_lock on the same CPU.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS