Executive brief
The Linux kernel's kernel connection multiplexer (KCM) networking feature allows custom BPF programs to parse network traffic. A missing RCU (read-copy-update) synchronization lock when running these BPF programs can cause kernel warnings and potentially allow attackers to trigger denial-of-service conditions by exploiting race conditions in BPF map operations.
Technical details
The vulnerability is a missing RCU read-side critical section in the KCM strparser's BPF program execution path. The function kcm_parse_func_strparser() calls bpf_prog_run_pin_on_cpu() which prevents CPU migration but does not establish proper RCU locking. Consequently, BPF map operations triggered from the KCM strparser can fail WARN_ON_ONCE(!bpf_rcu_lock_held()) checks. The fix adds rcu_read_lock() and rcu_read_unlock() calls around the BPF program execution. This is a local kernel bug requiring network capability to trigger via BPF-enabled KCM sockets, with the primary impact being denial of service through kernel warnings and potential system instability.
Affected products
- Linux Linux kernel 5.6 and later (KCM with BPF support)
Timeline
- 2026-09-17: disclosed: CVE-2026-90143 published
- 2026-08-13: patched: Upstream fix commit b0346dd64e4905291cc9c479f2e6cf1884ced4e6 by Junseo Lim
- 2026-09-14: patched: Backported to stable kernel branches