CVE-2026-98045: bpf: Mark faultable stack helpers as sleepable
In the Linux kernel, the following vulnerability has been resolved:
bpf: Mark faultable stack helpers as sleepable
The faultable variants of bpfgetstack() and bpfgettaskstack() pass mayfault=true into the common stack collection code. Resolving user-space build IDs may then call buildidparsefile() and block on filesystem reads.
Neither helper prototype sets mightsleep. Since prototype selection uses the sleepability of the whole program, the verifier can still allow these helpers from a non-sleepable region within that program, such as an explicit RCU or preemption-disabled region. The task-stack helper can also be called from a non-sleepable timer callback of a sleepable program.
Mark both faultable prototypes as sleepable. The existing helper context check then rejects these calls while continuing to allow them in genuinely sleepable contexts.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Configuration
Mark the faultable prototypes of bpf_get_stack() and bpf_get_task_stack() as sleepable so they are permitted only in genuinely sleepable contexts.
Linux kernel BPF faultable stack helpers sleepable = true
Event History
Frequently Asked Questions
Under what conditions can the unsafe blocking occur?
A BPF program must call a faultable variant of bpf_get_stack() or bpf_get_task_stack() from a non-sleepable region, such as an explicit RCU or preemption-disabled region. Resolving user-space build IDs can then trigger filesystem reads that block.
Are timer callbacks relevant to this issue?
Yes. bpf_get_task_stack() can be invoked from a non-sleepable timer callback even when the overall BPF program is sleepable, creating the same unsafe context for a potentially blocking operation.
What changes after the fix is applied?
The faultable helper prototypes are marked sleepable. Existing helper context checks then reject their use in non-sleepable contexts while continuing to permit them in genuinely sleepable contexts.