HIGH Introduced in 5.14
bpf BtfFindByNameKind Race
CVE-2026-98046
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
01Description
In the Linux kernel, the following vulnerability has been resolved: bpf: Mark bpf_btf_find_by_name_kind() as sleepable When bpf_btf_find_by_name_kind() finds a type in module BTF, it returns a new BTF object fd through __btf_new_fd(). This reaches anon_inode_getfd(), which can sleep while allocating or expanding the current task fd table. The helper prototype does not set might_sleep, so the verifier allows the helper in non-sleepable contexts such as BPF timer callbacks. The fd allocation can then sleep in softirq context and install the fd into the interrupted task. Mark the helper as sleepable. This preserves calls from the main body of a sleepable syscall program while rejecting calls from its non-sleepable regions.
02KernelScan AI Analysis
Risk summary
Local users who can load BPF programs can trigger a file descriptor allocation inside a software interrupt callback, causing the descriptor to be installed into an arbitrary interrupted process. On systems where the BPF capability is obtainable through a user namespace, this enables a container escape with high confidentiality, integrity, and availability impact.
Vulnerability analysis
A BPF helper that searches for type information can allocate a new file descriptor during its operation, which may sleep while expanding the calling task's file descriptor table. Because the helper was not flagged as sleepable, the BPF verifier permitted it in non-sleepable program regions such as timer callbacks that run in software interrupt context. When the file descriptor allocation sleeps in that context, the descriptor is installed into the file table of whichever task was interrupted, corrupting that task's state. The fix marks the helper as sleepable so the verifier rejects it in non-sleepable regions while still allowing it from sleepable program bodies. Triggering this requires the ability to load BPF programs (CAP_BPF), which on many configurations is obtainable through a user namespace, allowing an unprivileged local user to affect processes outside their container.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.1 | 5.14 | 6.1.189 | 7bf23cf7c9c0 |
| 6.6 | 5.14 | 6.6.158 | b843ab43ac9d |
| 6.12 | 5.14 | 6.12.111 | 29e401756172 |
| 6.18 | 5.14 | 6.18.53 | 4d8784226bd3 |
| 7.2 | 5.14 | 7.2.7 | 17f54a8f2b97 |
| mainline | 5.14 | 7.3-rc2 | 620614bf7672 |
| cip/6.12 | 5.14 | 6.12.111-cip32 | 29e401756172 |