CVE-2026-98046: bpf: Mark bpf_btf_find_by_name_kind() as sleepable
In the Linux kernel, the following vulnerability has been resolved:
bpf: Mark bpfbtffindbynamekind() as sleepable
When bpfbtffindbynamekind() finds a type in module BTF, it returns a new BTF object fd through btfnewfd(). This reaches anoninodegetfd(), which can sleep while allocating or expanding the current task fd table.
The helper prototype does not set mightsleep, so the verifier allows the helper in non-sleepable contexts such as BPF timer callbacks. The fd allocation can then sleep in softirq context and install the fd into the interrupted task.
Mark the helper as sleepable. This preserves calls from the main body of a sleepable syscall program while rejecting calls from its non-sleepable regions.
Affected Software
Event History
Frequently Asked Questions
What conditions are required to trigger this issue?
A BPF program must call bpf_btf_find_by_name_kind() from a non-sleepable context that the verifier previously allowed, such as a BPF timer callback. The vulnerable path is reached when the helper finds a type in module BTF and creates a new BTF file descriptor.
What is the practical impact of triggering it?
The helper can attempt file-descriptor allocation through anon_inode_getfd(), which may sleep while running in softirq context. It can also install the new file descriptor into the task that was interrupted.
What does the fix change for existing BPF programs?
The helper is marked sleepable. Calls remain permitted from the main body of a sleepable syscall program, but are rejected from its non-sleepable regions, including contexts such as BPF timer callbacks.