UBUNTU-CVE-2026-93137: Use After Free

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix use-after-free on mmstruct in bpffindvma() bpffindvma() reads task->mm and calls mmapreadtrylock(mm) without holding a reference on the mm. On a foreign task, a concurrent exitmm() can free the mmstruct between the lockless read and the trylock, resulting in a use-after-free. mmstruct is not SLABTYPESAFEBYRCU. For the current task, task->mm is stable. For a foreign task, pin the mm under task->alloclock and release it with mmputasync(), mirroring commit d8e27d2d22b6 ("bpf: fix mm lifecycle in open-coded taskvma iterator"). Use spintrylock() instead of gettaskmm() so BPF context does not block on alloclock. Reject irqs-disabled contexts and !CONFIGMMU on the foreign-task path because dropping the mm reference is not safe there. Race: CPU0 (BPF program) CPU1 (exiting task) ============================ ========================== bpffindvma(foreigntask): mm = task->mm exitmm(): task->mm = NULL mmput(mm) -> frees mmstruct mmapreadtrylock(mm) // UAF on mm