SB20260928150 - Improper locking in Linux kernel bpf

Description

This security bulletin contains information about 1 vulnerability.

1) Improper locking (CVE-ID: CVE-2026-98045)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper synchronization in the faultable bpf_get_stack() and bpf_get_task_stack() helper prototypes when resolving user-space build IDs from a non-sleepable context. A local user can invoke a faultable stack helper from a non-sleepable kernel context to cause a denial of service.

The task-stack helper can be invoked from a non-sleepable timer callback in a sleepable program.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/19e8d5a98afd071d8c1c5adeccf92b3c42eddc70
• https://git.kernel.org/stable/c/3014e8a8bdad55075d89836ad9c10710a9a69837
• https://git.kernel.org/stable/c/44b8d370f2725bad215da3e67668e98ba96671bd
• https://git.kernel.org/stable/c/9d02927fdf4e930893c92e35fed01a2704496900