CVE-2026-53084

In the Linux kernel, the following vulnerability has been resolved:

bpf: return VMA snapshot from task_vma iterator

Holding the per-VMA lock across the BPF program body creates a lock ordering problem when helpers acquire locks that depend on mmap_lock:

vmlock -> irwsem -> mmaplock -> vmlock

Snapshot the VMA under the per-VMA lock in _next() via memcpy(), then drop the lock before returning. The BPF program accesses only the snapshot.

The verifier only trusts vmmm and vmfile pointers (see BTFTYPESAFETRUSTEDORNULL in verifier.c). vmfile is reference- counted with getfile() under the lock and released via fput() on the next iteration or in destroy(). vmmm is already correct because lockvmaunderrcu() verifies vma->vm_mm == mm. All other pointers are left as-is by memcpy() since the verifier treats them as untrusted.