CVE-2026-43010: bpf: Reject sleepable kprobe_multi programs at attach time
In the Linux kernel, the following vulnerability has been resolved:
bpf: Reject sleepable kprobemulti programs at attach time
kprobe.multi programs run in atomic/RCU context and cannot sleep. However, bpfkprobemultilinkattach() did not validate whether the program being attached had the sleepable flag set, allowing sleepable helpers such as bpfcopyfromuser() to be invoked from a non-sleepable context.
This causes a "sleeping function called from invalid context" splat:
BUG: sleeping function called from invalid context at ./include/linux/uaccess.h:169 inatomic(): 1, irqsdisabled(): 0, nonblock: 0, pid: 1787, name: sudo preemptcount: 1, expected: 0 RCU nest depth: 2, expected: 0
Fix this by rejecting sleepable programs early in bpfkprobemultilinkattach(), before any further processing.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update the Linux kernel so that bpf_kprobe_multi_link_attach() validates the attached kprobe.multi program and rejects it at attach time if the program’s sleepable flag is set, preventing execution in atomic/RCU context where sleepable helpers (e.g., bpf_copy_from_user()) could otherwise be invoked.
Linux kernel BPF subsystem (bpf_kprobe_multi_link_attach / kprobe.multi attachment) Sleepable kprobe.multi program validation at attach time = Reject programs with sleepable flag before further processing
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43010?
CVE-2026-43010 has a medium severity level due to its potential to cause instability in kernel operations.
How do I fix CVE-2026-43010?
To fix CVE-2026-43010, update your Linux kernel to the latest stable version that includes the security patches addressing this vulnerability.
What systems are affected by CVE-2026-43010?
CVE-2026-43010 affects the Linux kernel, specifically those systems running configurations that utilize sleepable kprobe_multi programs.
What are the risks of CVE-2026-43010?
The risks associated with CVE-2026-43010 include potential kernel crashes and system instability due to improper execution of kprobe_multi programs.
Is there a workaround for CVE-2026-43010?
There are no recommended workarounds for CVE-2026-43010; the best approach is to apply the necessary updates to your Linux kernel.