Executive brief
The Linux kernel's BPF subsystem contains a resource leak in its memory-locking mechanism used during interrupt-disabled contexts. When two BPF operations compete for the same per-CPU work slot, one read lock may be acquired without a matching unlock, causing a process to hang during shutdown. This can lead to system instability or denial of service during exit operations.
Technical details
The vulnerability is a lock leak (CWE-416 / resource management issue) in kernel/bpf/mmap_unlock_work.h affecting the stack_map_get_build_id_offset() and bpf_find_vma() functions. Both functions use a shared per-CPU irq_work mechanism to defer mmap_read_unlock() calls from NMI context, but only check if the work is busy before acquiring mmap_lock. A nested caller can reuse the work slot before the first caller queues it, resulting in two acquired read locks but only one deferred unlock, leaking the lock and blocking exit_mmap(). The fix reserves the per-CPU slot atomically before mmap_read_trylock() and releases it only after the irq_work callback completes. No authentication or special privileges are required; the vulnerability affects normal kernel operation in interrupt-disabled contexts.
Affected products
- Linux Linux kernel 5.0+
Timeline
- 2026-09-17: disclosed: Published on NVD
- 2026-09-14: patched: Patch committed by Greg Kroah-Hartman in stable trees
- 2026-08-05: other: Upstream commit by Sanghyun Park