CVE-2026-90299: bpf: Fix sleepable check for tracing/lsm prog
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix sleepable check for tracing/lsm prog
When CONFIGFUNCTIONERRORINJECTION is disabled, a sleepable tracing prog is allowed to attach to 'x64'-alike prefix symbols.
It is because the verifier does not verify whether the symbol is a kernel function or a bpf prog. That said, a sleepable tracing prog is allowed to attach to a bpf prog target whose name has 'x64'-alike prefix.
For example, a sleepable fentry prog attaches to a 'x64sysnop' XDP prog, and copies buffer from a user pointer with bpfcopyfromuser() helper. After attaching the XDP prog to lo interface, the kernel BUG could be triggered by 'ping -c 1 -W 1 127.0.0.1':
[ 3.460756] BUG: sleeping function called from invalid context at kernel/bpf/trampoline.c:1324
Fix it by disallowing sleepable prog always when its target btf is not a kernel's btf.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernel BPF verifier/trampoline (bpf)to a version that resolves this vulnerability.Patch bpf: Fix sleepable check for tracing/lsm prog - Configuration
Disable CONFIG_FUNCTION_ERROR_INJECTION so that sleepable tracing programs are allowed/handled safely per the described fix context.
Linux kernel (BPF verifier/trampoline) CONFIG_FUNCTION_ERROR_INJECTION = disabled
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems are exposed when CONFIG_FUNCTION_ERROR_INJECTION is disabled and they allow a sleepable tracing or LSM BPF program to attach to a BPF program target whose name uses a '__x64_'-like prefix. The described example uses a sleepable fentry program attached to an XDP program.
What does an attacker need to trigger the failure?
An attacker needs the ability to load and attach BPF programs, including a sleepable tracing program and a target BPF program with a '__x64_'-like name. In the demonstrated case, attaching the XDP program to the loopback interface and sending a ping to 127.0.0.1 triggers a kernel BUG.
What configuration condition affects exploitability?
The vulnerable behavior is specifically described when CONFIG_FUNCTION_ERROR_INJECTION is disabled. The fix makes the verifier reject sleepable programs whenever the target BTF is not the kernel's BTF.
How can administrators identify potentially affected BPF setups?
Review attached sleepable tracing or LSM BPF programs for targets that are other BPF programs rather than kernel functions, particularly targets named with a '__x64_'-like prefix. A kernel log reporting 'sleeping function called from invalid context' in kernel/bpf/trampoline.c is consistent with the described failure.