CVE-2026-93137

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the bpf find vma() function. The function reads task->mm and calls mmap read trylock(mm) without holding a reference to the memory descriptor. When processing a foreign task, a concurrent exit mm() call can free the mm struct between the initial read and the trylock attempt, leading to a use-after-free condition. This occurs because mm struct is not SLAB TYPESAFE BY RCU, meaning it cannot be safely accessed via RCU (Read-Copy-Update) after being freed.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.