All vulnerabilities
CVE-2026-98058

Linux: bpf: Mark syscall helpers as sleepable

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 5% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in9496d857205e60241034b798d7745ff8830ba599Also 65f636322ac402add6046c68e9ece77b9ffd71c9, 3408e98f06ce06ea6a58ca6c39da9c23f0029c06CVE List
Published25 Sep 2026Updated 21 Oct 2026CVE List

What fixes it

  • 9496d857205e60241034b798d7745ff8830ba599LinuxCVE List
  • 65f636322ac402add6046c68e9ece77b9ffd71c9LinuxCVE List
  • 3408e98f06ce06ea6a58ca6c39da9c23f0029c06LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Mark syscall helpers as sleepable

bpf_sys_bpf() executes the bpf(2) syscall body, which can take mutexes, allocate with GFP_KERNEL, and wait for an RCU grace period. bpf_sys_close() reaches close_fd() and filp_close(), which can sleep as well.

Both helpers are limited to BPF_PROG_TYPE_SYSCALL, whose main program is sleepable. That does not make every callback sleepable: a syscall program can register a bpf_timer callback, and the verifier checks that callback in a non-sleepable context while retaining the syscall helper set.

Without .might_sleep on the prototypes, such a callback can invoke bpf_sys_bpf() from hrtimer softirq context and trigger a scheduling-while-atomic failure. bpf_sys_close() is exposed through the same missing context check.

Set .might_sleep on both prototypes so the existing helper-context check rejects them from timer callbacks and other atomic regions. Calls from the sleepable main body remain valid.

Text from CVE List

Affected versions 12

  • Linuxaffected: 79a7f8bdb159d9914b58740f3d31d602a6e4aca8 before 9496d857205e60241034b798d7745ff8830ba599CVE List
  • Linuxaffected: 79a7f8bdb159d9914b58740f3d31d602a6e4aca8 before d8cfe9f71d302970ae393616960f2b3021d2b3b0CVE List
  • Linuxaffected: 79a7f8bdb159d9914b58740f3d31d602a6e4aca8 before 65f636322ac402add6046c68e9ece77b9ffd71c9CVE List
  • Linuxaffected: 79a7f8bdb159d9914b58740f3d31d602a6e4aca8 before 3408e98f06ce06ea6a58ca6c39da9c23f0029c06CVE List
  • Linuxaffected: 79a7f8bdb159d9914b58740f3d31d602a6e4aca8 before d05524794240b52fdc3b6c1220dd05505715824dCVE List
  • Linuxaffected: 5.14CVE List
  • Linuxunaffected: all versions before 5.14CVE List
  • Linuxunaffected: 6.6.160 through 6.6.*CVE List
  • Linuxunaffected: 6.12.114 through 6.12.*CVE List
  • Linuxunaffected: 6.18.57 through 6.18.*CVE List
  • Linuxunaffected: 7.2.7 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5