CVE-2026-98058: bpf: Mark syscall helpers as sleepable
In the Linux kernel, the following vulnerability has been resolved:
bpf: Mark syscall helpers as sleepable
bpfsysbpf() executes the bpf(2) syscall body, which can take mutexes, allocate with GFPKERNEL, and wait for an RCU grace period. bpfsysclose() reaches closefd() and filpclose(), which can sleep as well.
Both helpers are limited to BPFPROGTYPESYSCALL, whose main program is sleepable. That does not make every callback sleepable: a syscall program can register a bpftimer callback, and the verifier checks that callback in a non-sleepable context while retaining the syscall helper set.
Without .mightsleep on the prototypes, such a callback can invoke bpfsysbpf() from hrtimer softirq context and trigger a scheduling-while-atomic failure. bpfsysclose() is exposed through the same missing context check.
Set .mightsleep on both prototypes so the existing helper-context check rejects them from timer callbacks and other atomic regions. Calls from the sleepable main body remain valid.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems that run BPF programs of type BPF_PROG_TYPE_SYSCALL are exposed if those programs register BPF timer callbacks that can invoke the affected syscall helpers. The issue is specific to calls made from non-sleepable contexts such as hrtimer softirq context; calls from the sleepable syscall program body remain valid.
What is required to trigger the problem?
A BPF_PROG_TYPE_SYSCALL program must register a bpf_timer callback and have that callback invoke bpf_sys_bpf() or bpf_sys_close(). Because the callback is checked as non-sleepable while retaining the syscall helper set, the helper can sleep in an atomic context and cause a scheduling-while-atomic failure.
How does the fix prevent exploitation?
The fix marks bpf_sys_bpf() and bpf_sys_close() as helpers that might sleep. The existing helper-context validation then rejects their use from timer callbacks and other atomic, non-sleepable regions.