CVE-2026-98060: bpf: Reject resilient lock operations in rbtree callbacks
In the Linux kernel, the following vulnerability has been resolved:
bpf: Reject resilient lock operations in rbtree callbacks
bpfrbtreeadd() keeps parent and link pointers live across calls to the program-supplied comparison callback. The verifier therefore requires the root's lock to remain held throughout the callback.
The helper path enforces this rule for bpfspinlock() and bpfspinunlock(), but the resilient lock kfunc argument path does not. Since resilient locks may protect BPF rbtree roots, a callback can release the root lock and let another CPU remove and free the node referenced by the in-progress tree walk. The walk then resumes using freed pointers.
Reject resilient lock kfuncs in an rbtree comparison callback, matching the existing policy for the spin lock helpers. Resilient-lock-protected trees remain valid when their comparison callbacks leave lock state alone.
Affected Software
Event History
Frequently Asked Questions
What conditions are required for this issue to be exploitable?
A BPF program must use an rbtree protected by a resilient lock and invoke a resilient-lock kfunc from the program-supplied rbtree comparison callback. Releasing the root lock during that callback can allow another CPU to remove and free a node while the tree walk still holds pointers to it.
Are resilient-lock-protected BPF rbtree programs affected if their comparison callbacks do not change lock state?
No. Resilient-lock-protected trees remain valid when their comparison callbacks leave the lock state unchanged.
What is the mitigation if the fix cannot be applied immediately?
Do not allow resilient lock kfunc operations in BPF rbtree comparison callbacks, especially operations that release the lock protecting the rbtree root. Keep the root lock held throughout the callback.