Executive brief
The Linux kernel's BPF (Berkeley Packet Filter) subsystem contains a race condition in the perf_event_output function that can be triggered when BPF programs are attached to user-space probes. Multiple tasks can preempt each other while accessing the same shared data buffer, leading to memory corruption and kernel crashes. This vulnerability affects systems running BPF-based monitoring or instrumentation tools.
Technical details
The vulnerability is a race condition (CWE-362) in kernel/trace/bpf_trace.c's bpf_perf_event_output() function. The function relies on disabled preemption to protect access to a per-CPU perf_sample_data buffer, but when called from uprobes context via bpf_prog_run_array_sleepable(), only CPU migration is disabled while preemption remains enabled. This allows a task to be preempted by another task within the critical section, causing both tasks to access and corrupt the same buffer simultaneously. The fix disables preemption explicitly using preempt_disable()/preempt_enable() around the critical section. The vulnerability can be exploited by a local attacker with privileges to attach BPF programs to uprobes, causing denial of service through kernel crashes.
Affected products
- Linux Linux Kernel Affected versions include Linux 5.8 and later through at least 6.x; patched in stable branches
Timeline
- 2023-07-25: disclosed: Patch authored by Jiri Olsa
- 2023-08-11: patched: Patch merged into stable kernel branches
- 2025-12-30: other: Advisory published with CVE-2023-54303