HIGH Introduced in 4.6
bpf StackId Race
CVE-2026-89799
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI3.6LOW
01Description
In the Linux kernel, the following vulnerability has been resolved: bpf: Disable preemption in bpf_get_stackid The get_perf_callchain call needs disabled preemption plus we need it disabled as long as we access its returned trace entries buffer. Note the bpf_get_stackid_pe function is executed already with preemption disabled.
02KernelScan AI Analysis
Risk summary
A local attacker who can load BPF programs can exploit a missing preemption guard in the stack trace helper to trigger a race condition on per-CPU callchain data. This can lead to kernel information leaks and incorrect data in BPF stack maps. Systems that allow unprivileged BPF are at greatest risk, but any local user with CAP_BPF is affected.
Vulnerability analysis
The BPF stack trace helper captures a per-CPU callchain buffer and then reads its contents without holding the CPU exclusively. Because preemption is not disabled around the capture and subsequent access, another task running on the same CPU can overwrite that buffer in between, causing the helper to use stale or inconsistent trace data when computing a stack identifier. The fix ensures the helper runs to completion without interruption so the trace entries remain stable for the entire operation. This helper is reachable from BPF programs, which require CAP_BPF to load on most distributions, though systems with unprivileged BPF enabled would allow any local user to trigger it.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.12 | 4.6 | 6.12.111 | 18c71e4b65ee |
| mainline | 4.6 | 7.3-rc1 | 15f1bd857466 |
| 7.2 | 4.6 | 7.2.5 | c4efdc1d4cb3 |
| 6.18 | 4.6 | 6.18.51 | ccf481d73bce |
| cip/6.12 | 4.6 | 6.12.111-cip32 | 18c71e4b65ee |