Bug 2541151 (CVE-2026-98045) - CVE-2026-98045 kernel: bpf: Mark faultable stack helpers as sleepable
Summary: CVE-2026-98045 kernel: bpf: Mark faultable stack helpers as sleepable
Keywords:
Status: NEW
Alias: CVE-2026-98045
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-09-25 10:52 UTC by OSIDB Bzimport
Modified: 2026-09-28 23:15 UTC (History)
17 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description OSIDB Bzimport 2026-09-25 10:52:38 UTC
In the Linux kernel, the following vulnerability has been resolved:

bpf: Mark faultable stack helpers as sleepable

The faultable variants of bpf_get_stack() and bpf_get_task_stack() pass
may_fault=true into the common stack collection code. Resolving user-space
build IDs may then call build_id_parse_file() and block on filesystem
reads.

Neither helper prototype sets might_sleep. Since prototype selection uses
the sleepability of the whole program, the verifier can still allow these
helpers from a non-sleepable region within that program, such as an
explicit RCU or preemption-disabled region. The task-stack helper can also
be called from a non-sleepable timer callback of a sleepable program.

Mark both faultable prototypes as sleepable. The existing helper context
check then rejects these calls while continuing to allow them in genuinely
sleepable contexts.


Note You need to log in before you can comment on or make changes to this bug.