The Linux kernel’s BPF task_vma iterator reads the task structure’s mm field without acquiring a reference, relying on a lock‑free read that omits mmget(). If the target process exits concurrently, the mm_struct can be freed while the iterator still holds a stale pointer, resulting in a use‑after‑free that can be used to read or write arbitrary kernel memory, enabling privilege escalation or denial of service. The defect is resolved by adding proper mm reference counting, a trylock on alloc_lock, context checks, and a fall‑back to mmput on non‑MMU systems, preventing concurrent access to a deallocated mm_struct.

All current releases of the Linux kernel prior to the inclusion of the commit identified by 239cec25a22662dbd80f57d94b38178c8be95269 (and subsequent commits) are vulnerable. The flaw touches the BPF subsystem, so any kernel version that allows user‑supplied BPF programs without additional hardening is affected.

The severity is high because the flaw permits kernel memory corruption. Exploitation requires the ability to load or execute a BPF program, typically requiring CAP_BPF or CAP_SYS_ADMIN, so the attack vector is local privilege escalation. EPSS is not available, and the vulnerability is not listed in CISA KEV at this time, but the canonical CVSS score would be in the 9.x range based on the use‑after‑free and arbitrary kernel memory access capability. Attackers could trigger the flaw by injecting a malicious BPF program that iterates a task_vma, causing the freed mm_struct to be accessed.