Technical impact
An open‑coded iterator in the Linux kernel’s BPF subsystem reads a process’s mm structure without obtaining an mm reference, relying only on mmap_read_trylock. If the target process terminates while the iterator is active, its mm_struct may be freed, causing a use‑after‑free that corrupts kernel memory (CWE‑416) and enables arbitrary kernel data overwrites (CWE‑825). The correction introduces mm reference counting, a trylock on alloc_lock, and rejection of IRQ‑disabled contexts, which together prevent stale mm_struct access.
Affected Systems
All Linux kernel releases that lack commit 239cec25a22662dbd80f57d94b38178c8be95269 or later are affected. The flaw resides in the eBPF task_vma iterator, so any kernel configuration that permits eBPF program loading is potentially vulnerable.
Risk and Exploitability
The CVSS score of 7.8 indicates high severity; the EPSS score of <1% suggests the exploitation probability is low at present, and the issue is not listed in CISA KEV. Exploitation is inferred to require the ability to load a BPF program that uses the task_vma iterator, which normally requires CAP_BPF. Once exploited, an attacker could achieve kernel memory corruption, leading to privilege escalation or denial of service.
Ubuntu USN