All vulnerabilities
CVE-2026-98046

Linux: bpf: Mark bpf_btf_find_by_name_kind() as sleepable

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 6% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in7bf23cf7c9c0e0b5e638e497cdc0ec3f223742ccAlso 29e40175617216fbd4544529f6bfb51d1ab95ba1, 4d8784226bd3c6a707975081f986078f40456cec and 2 moreCVE List
Published25 Sep 2026Updated 19 Oct 2026CVE List

What fixes it

  • 7bf23cf7c9c0e0b5e638e497cdc0ec3f223742ccLinuxCVE List
  • 29e40175617216fbd4544529f6bfb51d1ab95ba1LinuxCVE List
  • 4d8784226bd3c6a707975081f986078f40456cecLinuxCVE List
  • 17f54a8f2b9714529d56edbbe12d448ccdbbf469LinuxCVE List
  • 620614bf7672130c43b3cff375525a2202f61979LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Mark bpf_btf_find_by_name_kind() as sleepable

When bpf_btf_find_by_name_kind() finds a type in module BTF, it returns a new BTF object fd through __btf_new_fd(). This reaches anon_inode_getfd(), which can sleep while allocating or expanding the current task fd table.

The helper prototype does not set might_sleep, so the verifier allows the helper in non-sleepable contexts such as BPF timer callbacks. The fd allocation can then sleep in softirq context and install the fd into the interrupted task.

Mark the helper as sleepable. This preserves calls from the main body of a sleepable syscall program while rejecting calls from its non-sleepable regions.

Text from CVE List

Affected versions 14

  • Linuxaffected: 3d78417b60fba249cc555468cb72d96f5cde2964 before 7bf23cf7c9c0e0b5e638e497cdc0ec3f223742ccCVE List
  • Linuxaffected: 3d78417b60fba249cc555468cb72d96f5cde2964 before b843ab43ac9d2fa1ddd0dab8d0dcc19dbf764e2fCVE List
  • Linuxaffected: 3d78417b60fba249cc555468cb72d96f5cde2964 before 29e40175617216fbd4544529f6bfb51d1ab95ba1CVE List
  • Linuxaffected: 3d78417b60fba249cc555468cb72d96f5cde2964 before 4d8784226bd3c6a707975081f986078f40456cecCVE List
  • Linuxaffected: 3d78417b60fba249cc555468cb72d96f5cde2964 before 17f54a8f2b9714529d56edbbe12d448ccdbbf469CVE List
  • Linuxaffected: 3d78417b60fba249cc555468cb72d96f5cde2964 before 620614bf7672130c43b3cff375525a2202f61979CVE List
  • Linuxaffected: 5.14CVE List
  • Linuxunaffected: all versions before 5.14CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.111 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2.7 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 6