Executive brief
The Linux kernel's eBPF (extended Berkeley Packet Filter) subsystem, used for in-kernel virtual machines and networking optimizations, contains a deadlock vulnerability in memory fault handling. When the arena memory management component fails to acquire an internal lock, it incorrectly signals a retry condition that causes the memory lock to be acquired twice, leading to a system deadlock that can hang applications or the entire system.
Technical details
The vulnerability is a deadlock in the arena_vm_fault() function in kernel/bpf/arena.c. When raw_res_spin_lock_irqsave(&arena->spinlock) fails, the function returns VM_FAULT_RETRY without having acquired mmap_lock. However, the caller (do_user_addr_fault()) assumes VM_FAULT_RETRY means the handler already released mmap_lock and re-acquires it on retry, causing a double-lock condition. This leads to deadlock because the fault path retries and attempts to acquire the same already-held lock. The fix changes the return value from VM_FAULT_RETRY to VM_FAULT_SIGBUS, signaling failure instead of retry, since a failed spinlock acquisition indicates a possible deadlock was already detected and retrying would only hit the same lock again.
Affected products
- Linux Linux kernel 5.12 and later (bpf: arena feature introduced in commit b8467290edab)
Timeline
- 2026-09-17: disclosed
- 2026-08-03: patched: Patch merged into upstream kernel