Executive brief
A vulnerability in the Linux kernel's BPF subsystem could allow for system deadlocks. This occurs when specific memory management functions are used within BPF programs, potentially causing the system to hang or become unresponsive. This issue primarily affects system stability and availability for users running specialized monitoring or security software.
Technical details
A lock inversion vulnerability exists in the Linux kernel BPF subsystem when using the task_vma iterator. Holding the per-VMA lock across the BPF program body creates a circular dependency (vm_lock -> i_rwsem -> mmap_lock -> vm_lock) when BPF helpers attempt to acquire locks dependent on mmap_lock. The fix involves snapshotting the VMA structure using memcpy() while under the per-VMA lock and then immediately releasing the lock before the BPF program executes. This ensures the BPF program only operates on a snapshot, breaking the deadlock chain. The fix also includes proper reference counting for vm_file to maintain memory safety.
Affected products
- Linux Linux 6.7 to 6.12.91, 6.18.33, 7.0.10
Timeline
- 2026-06-24: advisory
- 2026-06-24: disclosed