Executive brief
The Linux kernel's BPF subsystem contains a logic error in memory management that can cause the system to hang indefinitely on single-CPU systems. When an interrupt handler tries to access a memory structure that is already locked by the interrupted code, the system enters an infinite loop and stops responding.
Technical details
The vulnerability exists in __pcpu_freelist_push() where an NMI context can re-enter while the interrupted context holds the current CPU's freelist lock. On systems with only one possible CPU (CONFIG_SMP=n, nr_cpus=1, or possible_cpus=1), the fallback loop iterates over cpu_possible_mask while skipping the current CPU, resulting in no candidates to examine. Since no lock acquisition attempt is made, the loop cannot progress and hangs indefinitely. The fix restores a pre-rqspinlock conversion extra fallback head that allows the push operation to succeed when the only per-CPU head is held by interrupted context, and updates the pop path to check this extra head for node reuse.
Affected products
- Linux Linux kernel <UNKNOWN>
Timeline
- 2026-09-16: disclosed