Executive brief
The Linux kernel's eBPF subsystem contains a race condition in the bpf_event_output function used to output performance event data. When eBPF programs execute with preemption enabled but migration disabled, a task can be preempted and replaced by another task that uses the same per-CPU buffer, causing kernel memory corruption and crash. This affects systems running eBPF programs, particularly those using cgroup-based filtering in network or security tools.
Technical details
The vulnerability is a race condition (CWE-362) in the bpf_event_output function in kernel/trace/bpf_trace.c. The function relies on nesting protection (this_cpu_inc_return) to manage access to a per-CPU perf_sample_data buffer, but does not disable preemption while accessing this shared resource. When bpf_event_output is called from bpf_prog_run_array_cg (which disables migration but not preemption), a task can be preempted mid-execution, allowing another task to use the same buffer concurrently. This leads to memory corruption visible as NULL pointer dereferences in perf_output_sample and other kernel functions. The fix disables preemption around the critical section using preempt_disable() and preempt_enable(). Patch availability confirmed via upstream commit d62cc390c2e99ae267ffe4b8d7e2e08b6c758c32.
Affected products
- Linux Linux kernel 5.0 and later (variable by distribution)
Timeline
- 2023-07-25: disclosed
- 2023-08-11: patched
- 2025-12-30: other: CVE assigned