Executive brief
The Linux kernel's BPF (Berkeley Packet Filter) runtime allows loading and executing custom programs that can interact with kernel subsystems. A flaw in the BPF verifier failed to reject sleepable BPF programs attached to LSM (Linux Security Module) cgroup hooks, causing them to sleep while holding locks they should never sleep under. An attacker with BPF loading privileges could exploit this to trigger kernel panics or potentially escalate privileges by forcing a kernel panic in a controlled context.
Technical details
This is a logic error in the BPF verifier's can_be_sleepable() function in kernel/bpf/verifier.c. The verifier failed to distinguish between BPF_PROG_TYPE_LSM programs intended for cgroup attachment (BPF_LSM_CGROUP) and those for general LSM hooks. Cgroup LSM programs execute under rcu_read_lock_dont_migrate(), a context that forbids sleeping. When a sleepable LSM cgroup program calls blocking functions like bpf_get_dentry_xattr(), the kernel triggers a "sleeping function called from invalid context" panic. Exploitation requires the ability to load BPF programs (typically root or CAP_BPF + CAP_PERFMON) and use the raw bpf(2) syscall to bypass libbpf's protections. The fix adds an explicit check to reject sleepable programs when expected_attach_type == BPF_LSM_CGROUP.
Affected products
- Linux Linux kernel Affected versions include those with per-cgroup LSM support (introduced in Linux 5.13+); patched in commit 5b038319be442c620f774e6fc9e9283deeca1c75
Timeline
- 2026-08-15: disclosed: CVE published
- 2026-06-07: patched: Fix committed upstream
- 2026-07-24: other: Backported to stable kernels