CVE-2026-98058: bpf: Mark syscall helpers as sleepable

Published Sep 25, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

bpf: Mark syscall helpers as sleepable

bpfsysbpf() executes the bpf(2) syscall body, which can take mutexes, allocate with GFPKERNEL, and wait for an RCU grace period. bpfsysclose() reaches closefd() and filpclose(), which can sleep as well.

Both helpers are limited to BPFPROGTYPESYSCALL, whose main program is sleepable. That does not make every callback sleepable: a syscall program can register a bpftimer callback, and the verifier checks that callback in a non-sleepable context while retaining the syscall helper set.

Without .mightsleep on the prototypes, such a callback can invoke bpfsysbpf() from hrtimer softirq context and trigger a scheduling-while-atomic failure. bpfsysclose() is exposed through the same missing context check.

Set .mightsleep on both prototypes so the existing helper-context check rejects them from timer callbacks and other atomic regions. Calls from the sleepable main body remain valid.

Affected Software

1 affected component
Linux Linux kernel

Event History

Sep 25, 2026
CVE Published
via MITRE·10:24 AM
Data Sourced
via MITRE·10:24 AM
Description

Frequently Asked Questions

1

Which systems are exposed to this issue?

Systems that run BPF programs of type BPF_PROG_TYPE_SYSCALL are exposed if those programs register BPF timer callbacks that can invoke the affected syscall helpers. The issue is specific to calls made from non-sleepable contexts such as hrtimer softirq context; calls from the sleepable syscall program body remain valid.

2

What is required to trigger the problem?

A BPF_PROG_TYPE_SYSCALL program must register a bpf_timer callback and have that callback invoke bpf_sys_bpf() or bpf_sys_close(). Because the callback is checked as non-sleepable while retaining the syscall helper set, the helper can sleep in an atomic context and cause a scheduling-while-atomic failure.

3

How does the fix prevent exploitation?

The fix marks bpf_sys_bpf() and bpf_sys_close() as helpers that might sleep. The existing helper-context validation then rejects their use from timer callbacks and other atomic, non-sleepable regions.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203