Executive brief
The Linux kernel's BPF (Berkeley Packet Filter) subsystem contains a race condition in stack trace collection that occurs when preemption is not properly disabled. This vulnerability could allow a local attacker to cause a denial of service or potentially corrupt kernel memory by triggering concurrent access to shared stack trace buffers.
Technical details
The vulnerability is a concurrency issue in the bpf_get_stackid function within kernel/bpf/stackmap.c. The get_perf_callchain() function and subsequent accesses to its returned trace buffer require preemption to be disabled for the entire critical section, but preemption was not being guarded. An attacker with local kernel access could trigger the race condition by calling BPF eBPF programs that use stack trace maps concurrently, leading to use-after-free or buffer corruption. The fix wraps the vulnerable code section with a scoped_guard(preempt) to ensure preemption remains disabled throughout the entire operation. This is a local privilege escalation vector requiring kernel code execution capability.
Affected products
- Linux Linux kernel multiple versions, patched in stable trees
Timeline
- 2026-09-16: disclosed: CVE-2026-89799 published
- 2026-08-05: patched: Fix merged upstream (commit 15f1bd8574662f1b7b26aaa2e23ebf4066f0117d)
- 2026-09-21: patched: Fix backported to stable kernels (commit 18c71e4b65ee60b8611fc071bdd7159f10185117)