Executive brief
A vulnerability was identified in the Linux kernel's BPF subsystem where certain security hooks were incorrectly marked as 'sleepable.' In practice, this could lead to system instability or crashes because these specific security checks are performed in technical contexts where the system is not allowed to pause or 'sleep.' This issue primarily affects system reliability and the proper functioning of security monitoring tools.
Technical details
A vulnerability in the Linux kernel BPF subsystem (specifically BPF LSM) allowed the hooks 'task_to_inode' and 'inet_conn_established' to be used by sleepable BPF programs. However, 'bpf_lsm_task_to_inode()' is invoked under an RCU read-side critical section, and 'bpf_lsm_inet_conn_established()' is called from a softirq context. Neither of these execution contexts permits sleeping. An attacker or a misconfigured BPF program utilizing these hooks in a sleepable manner could trigger kernel assertions or deadlocks. The fix involves removing these hooks from the 'sleepable_lsm_hooks' set in 'kernel/bpf/bpf_lsm.c'.
Affected products
- Linux Linux Kernel 5.11 to 7.0.10
Timeline
- 2026-07-19: disclosed
- 2026-07-19: advisory
References
- https://git.kernel.org/stable/c/0d918263c9bfc86078edb2e2f7302a0c6ce42b7c
- https://git.kernel.org/stable/c/26b380a3ca0b605fd8860995ed6a208f276dd316
- https://git.kernel.org/stable/c/281f2a214565a5cbf8b7355a65738d80bd19b8c5
- https://git.kernel.org/stable/c/452a927cddcd67478d030e646f41cb904a93156f
- https://git.kernel.org/stable/c/989f1b93907de1753a814996222da375f07e579b
- https://git.kernel.org/stable/c/beaf0e96b1da74549a6cabd040f9667d83b2e97e
- https://git.kernel.org/stable/c/f0fc2a9828171205244a28013f02889f50b71c9f