Executive brief
The Linux kernel's eBPF subsystem contained a race condition in how it initializes and publishes the vmlinux Binary Type Format (BTF) structure. On weakly-ordered processor architectures, concurrent access could allow threads to observe an incompletely initialized BTF structure, potentially leading to memory corruption or kernel crashes.
Technical details
The vulnerability is a data race in the bpf_get_btf_vmlinux() function within kernel/bpf/verifier.c. The function lazily initializes the vmlinux BTF under mutex protection but published the result through a plain store and re-checked it through a plain lockless load, providing no memory ordering guarantees. On weakly-ordered architectures (ARM, PowerPC), a concurrent caller on the lockless fast path could observe the pointer before the parsed BTF contents and related globals were visible in memory. The fix replaces the plain store with smp_store_release() and the plain load with smp_load_acquire() to enforce proper acquire/release semantics across all threads. This is preferable to dependency-ordered READ_ONCE() because btf_parse_vmlinux() also populates globals external to the returned struct.
Affected products
- Linux Linux kernel versions with CONFIG_DEBUG_INFO_BTF enabled, patched in upstream and stable releases
Timeline
- 2026-07-08: other: Fix committed by Daniel Borkmann
- 2026-09-17: disclosed: CVE-2026-93138 published
- 2026-09-14: patched: Fix backported to stable kernel branches