Executive brief
A vulnerability in the Linux kernel's BPF (Berkeley Packet Filter) subsystem can cause the system to become unresponsive or 'stall' under certain conditions. This occurs when clearing large internal data structures (PROG_ARRAY maps), which can monopolize the processor and prevent other critical system tasks from running. An exploit could lead to a denial-of-service, impacting the availability of the affected server or device.
Technical details
A vulnerability exists in the Linux kernel's BPF subsystem due to a missing scheduling point in the `bpf_fd_array_map_clear()` function. When processing PROG_ARRAY maps with a large number of entries, the loop calls `prog_array_map_poke_run()` for each entry. Because this loop does not yield the CPU (missing `cond_resched()`), it can cause Read-Copy-Update (RCU) stalls under heavy load. This is a local denial-of-service vector where a user capable of triggering BPF map clearing can cause a kernel hang. The issue has been resolved by adding `cond_resched()` to the loop to ensure the kernel can perform necessary scheduling and RCU grace period tasks.
Affected products
- Linux Linux 5.5 to 6.14
Timeline
- 2026-04-07: other: Patch authored
- 2026-06-24: disclosed: CVE published
References
- https://git.kernel.org/stable/c/4406942e65ca128c56c67443832988873c21d2e9
- https://git.kernel.org/stable/c/67bdb4b0d26f2d6bbf1798a925ef5a3b9ed7357a
- https://git.kernel.org/stable/c/71ddb7defc442ab38c53123c384fedbfd8410a15
- https://git.kernel.org/stable/c/b1f7158a86f3cbac4d5a32beb55ca0f8027d44cd
- https://git.kernel.org/stable/c/e1ed678855e315f90c70c1723e94157a9a82e660