Executive brief
A vulnerability in the Linux kernel's BPF (Berkeley Packet Filter) subsystem could cause a system deadlock, leading to a complete freeze or crash. This occurs when specific storage deletion tasks are performed during high-priority hardware interrupts. While this scenario is rare in normal operations, it could impact system availability and reliability in specialized environments.
Technical details
A deadlock vulnerability exists in the Linux kernel BPF subsystem due to unsafe memory reclamation in Non-Maskable Interrupt (NMI) contexts. Specifically, the bpf_selem_unlink function could trigger a deadlock when deferring the freeing of local storage elements via RCU callbacks (kfree_rcu, call_rcu) while running in an NMI or reentrant context. An attacker or a malicious BPF program could potentially trigger this condition to cause a Denial of Service (DoS). The fix introduces a check using in_nmi() within bpf_selem_unlink() to return -EOPNOTSUPP when called from an NMI context, preventing the unsafe execution path. Patches have been backported to various stable kernel branches.
Affected products
- Linux Linux 5.13 to 7.0.10
Timeline
- 2026-06-24: disclosed
- 2026-06-24: advisory