CVE-2026-53084: bpf: return VMA snapshot from task_vma iterator

In the Linux kernel, the following vulnerability has been resolved:

bpf: return VMA snapshot from taskvma iterator

Holding the per-VMA lock across the BPF program body creates a lock ordering problem when helpers acquire locks that depend on mmaplock:

vmlock -> irwsem -> mmaplock -> vmlock

Snapshot the VMA under the per-VMA lock in next() via memcpy(), then drop the lock before returning. The BPF program accesses only the snapshot.

The verifier only trusts vmmm and vmfile pointers (see BTFTYPESAFETRUSTEDORNULL in verifier.c). vmfile is reference- counted with getfile() under the lock and released via fput() on the next iteration or in destroy(). vmmm is already correct because lockvmaunderrcu() verifies vma->vmmm == mm. All other pointers are left as-is by memcpy() since the verifier treats them as untrusted.