CVE-2026-98646: tcp: Skip cond_resched() in inet_csk_listen_stop() under BPF context
In the Linux kernel, the following vulnerability has been resolved:
tcp: Skip condresched() in inetcsklistenstop() under BPF context
bpfsockdestroy() runs from the tcp iterator, under rcureadlock(). If the sock is a listener that still has children in its accept queue, tcpabort() ends up in inetcsklistenstop() and the condresched() there trips the debug check:
BUG: sleeping function called from invalid context at net/ipv4/inetconnectionsock.c:1523 inatomic(): 0, irqsdisabled(): 0, nonblock: 0, pid: 628, name: testprogs preemptcount: 0, expected: 0 RCU nest depth: 1, expected: 0 locks held by testprogs/628: 3, last CPU#3: #0: ffff8881158cee18 (&p->lock){+.+.}-{4:4}, at: bpfseqread+0x56/0x1210 #1: ffff8881106bb858 (sklock-AFINET6){+.+.}-{0:0}, at: bpfitertcpseqshow+0x32b/0x4b0 #2: ffffffffb435af20 (rcureadlock){....}-{1:3}, at: bpfiterrunprog+0x46b/0xde0 CPU: 3 UID: 0 PID: 628 Comm: testprogs Tainted: G W 7.2.0+ #65 PREEMPT Tainted: [W]=WARN Call Trace: <TASK> dumpstacklvl+0xc1/0xf0 dumpstack+0x10/0x20 mightresched+0x3d2/0x610 inetcsklistenstop+0x7b/0xbf0 tcpabort+0x23b/0x3b0 bpfsockdestroy+0xfc/0x140 bpfprog448133d24601754fitertcp6server+0x81/0x8a bpfiterrunprog+0x538/0xde0 bpfitertcpseqshow+0x26b/0x4b0 bpfseqread+0x424/0x1210 vfsread+0x197/0xe40 ksysread+0x119/0x240 x64sysread+0x72/0xc0 x64syscall+0x647/0x27e0 dosyscall64+0xe5/0x610 entrySYSCALL64afterhwframe+0x76/0x7e RIP: 0033:0x7fad39b28aca RSP: 002b:00007ffc381c61c0 EFLAGS: 00000246 ORIGRAX: 0000000000000000 RAX: ffffffffffffffda RBX: 00007ffc381c6a88 RCX: 00007fad39b28aca RDX: 0000000000000032 RSI: 00007ffc381c6250 RDI: 0000000000000014 RBP: 00007ffc381c61e0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003 R13: 0000000000000000 R14: 000055f077c1bbb0 R15: 00007fad3a0f3000 </TASK>
The commit that added the kfunc already guards locksock() in tcpabort() and udpabort() with hascurrentbpfctx(), but missed the listener path. Do the same for the condresched(). The loop runs inside the iterator's rcureadlock(), it must not reschedule or report a quiescent state there.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Skip cond_resched() in inet_csk_listen_stop() when running under BPF context, because the function executes while rcu_read_lock() is held.
Event History
Frequently Asked Questions
What conditions are required to trigger the warning?
The issue occurs when bpf_sock_destroy() runs from the TCP BPF iterator under rcu_read_lock(), destroys a listening socket, and that listener still has children in its accept queue. This path reaches inet_csk_listen_stop(), where cond_resched() is called from an invalid RCU context.
How can I tell whether a system has encountered this issue?
Affected systems can emit a kernel warning stating "BUG: sleeping function called from invalid context" at net/ipv4/inet_connection_sock.c:1523. The stack trace includes inet_csk_listen_stop(), tcp_abort(), bpf_sock_destroy(), and TCP BPF iterator functions such as bpf_iter_tcp_seq_show or bpf_iter_run_prog.
Is there a documented workaround if updates cannot be applied immediately?
No workaround is provided in the available data. Avoiding the triggering path would require not destroying listening sockets with queued accepted children through the TCP BPF iterator while it runs under RCU read-side protection.