Junglewise Threat Intelligence

CVE-2026-64352: Linux Kernel RCU lockdep warning in BPF LPM trie access

CVE-2026-64352 · Severity: info · CVSS 0 · Published 2026-07-25

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A technical issue was identified in the Linux kernel's BPF (Berkeley Packet Filter) subsystem. Specifically, certain security and networking programs (BPF programs) that are allowed to 'sleep' were incorrectly triggering internal warnings when accessing Longest Prefix Match (LPM) data maps. While this does not lead to data corruption or a system crash, it causes significant noise in system logs on debug-enabled kernels and could hinder the monitoring of other legitimate security events.

Technical details

The vulnerability is a lockdep-only false positive in the BPF LPM trie implementation. trie_lookup_elem() used rcu_dereference_check() with only rcu_read_lock_bh_held() validation, which failed to account for sleepable BPF programs holding rcu_read_lock_trace(). Similarly, trie_update_elem() and trie_delete_elem() used plain rcu_dereference() which asserts classic RCU locks, despite being protected by an internal rqspinlock. The fix updates these functions to use bpf_rcu_lock_held() and rcu_dereference_protected() respectively, correctly accounting for sleepable contexts and spinlock protection. There is no risk of Use-After-Free (UAF) as Tasks Trace RCU properly serializes against the trie's reclaim path.

Affected products

  • Linux Linux Kernel 7.1.0

Timeline

  • 2026-06-09: patched: Initial fix committed to mainline kernel.
  • 2026-07-25: advisory: CVE-2026-64352 published.

References

Related threats