CVE-2026-93138: bpf: Fix vmlinux BTF prep race in bpf_get_btf_vmlinux
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix vmlinux BTF prep race in bpfgetbtfvmlinux
bpfgetbtfvmlinux() lazily parses the vmlinux BTF under the bpfverifierlock, but publishes the result through a plain store and re-checks it through a plain lockless load. Nothing orders the stores initializing the struct btf inside btfparsevmlinux() against the store publishing the pointer: On a weakly ordered arch, a concurrent first-time caller taking the lockless fast path could in principle observe the pointer before the parsed contents are visible. The mutexunlock() does not help such a reader given it only synchronizes with a later acquisition of the same lock. Thus, publish the pointer with smpstorerelease() and read it on the fast path with smploadacquire().
Acquire semantics are needed rather than a dependency-ordered READONCE(): btfparsevmlinux() also populates globals outside the returned object (e.g. bpfctxconvert.t). An address dependency would only order accesses performed through the pointer and not cover other globals.
Event History
Frequently Asked Questions
Which systems are exposed to the race condition?
The issue can occur on weakly ordered architectures when concurrent first-time callers access vmlinux BTF. A caller using the lockless fast path could observe the published pointer before the BTF contents and related global state are visible.
What must a correct fix provide?
The vmlinux BTF pointer must be published with release semantics and read on the lockless fast path with acquire semantics. A dependency-ordered read alone is insufficient because parsing also initializes globals outside the returned BTF object.