CVE-2026-98046: bpf: Mark bpf_btf_find_by_name_kind() as sleepable
bpf: Mark bpfbtffindbynamekind() as sleepable
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.158.1-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Configuration
Mark bpf_btf_find_by_name_kind() as sleepable so the verifier rejects it in non-sleepable contexts such as BPF timer callbacks.
Linux kernel BPF helper bpf_btf_find_by_name_kind() sleepable = true
Event History
Frequently Asked Questions
What conditions are required to trigger this issue?
A BPF program must call bpf_btf_find_by_name_kind() from a non-sleepable context that the verifier previously allowed, such as a BPF timer callback. The vulnerable path is reached when the helper finds a type in module BTF and creates a new BTF file descriptor.
What is the practical impact of triggering it?
The helper can attempt file-descriptor allocation through anon_inode_getfd(), which may sleep while running in softirq context. It can also install the new file descriptor into the task that was interrupted.
What does the fix change for existing BPF programs?
The helper is marked sleepable. Calls remain permitted from the main body of a sleepable syscall program, but are rejected from its non-sleepable regions, including contexts such as BPF timer callbacks.