CVE-2026-93137

A flaw was found in the Linux kernel's Berkeley Packet Filter (BPF) subsystem. A use-after-free vulnerability exists in the bpf_find_vma() function. This occurs when bpf_find_vma() attempts to access memory management structures (mm_struct) of a different process. A race condition can arise where the target process exits and frees its mm_struct while bpf_find_vma() still holds a reference to it. This can allow a local attacker to cause a denial of service or potentially escalate privileges.

A use-after-free can occur in bpf_find_vma() because the helper reads the mm_struct pointer from a foreign task without holding a reference. A concurrent exit_mm() on that task can clear task mm and free the mm_struct before mmap_read_trylock() is called, so the BPF path may operate on freed kernel memory. For the CVSS the PR:L is used because exploitation requires local ability to run a relevant BPF program or a delegated BPF capable context, but it does not require network reachability. The attack complexity is high because the bug depends on winning a race against task exit. Impact is at least a local denial of service via kernel crash and in worst case may allow confidentiality or integrity impact due to use-after-free memory corruption, so this should be reviewed manually.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.