CVE-2026-98799: bpf: Skip detached progs in trampoline images that are still in use
bpf: Skip detached progs in trampoline images that are still in use
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Modify the BPF trampoline implementation so JITs emit and record a patchable nop before each program call sequence, and when a program is detached, patch that nop to a jump over the call sequence in every still-live trampoline image; reduce BPF_MAX_TRAMP_LINKS on x86 and arm64 to account for the added nops.
Event History
Frequently Asked Questions
What conditions are required to trigger this issue?
A task must be executing a trampoline image containing a sleepable BPF program and sleep before a later attached program runs. That later program must then be detached and lose its final reference while the task remains asleep, allowing it to be freed before execution resumes.
Which BPF program arrangements are implicated?
The described failure applies when the sleeping program and the detached program are fexit programs. The description notes that fentry-only trampoline images do not have the relevant patched jump behavior.
What is the likely impact if the race occurs?
When the sleeping task resumes, it can attempt to call a freed BPF program. On x86, the reported result is an int3 exception from poisoned bpf_prog_pack memory, producing a kernel Oops.
How can I tell whether a system has experienced this issue?
The provided example shows a kernel Oops on x86 with an int3 instruction fault and a call trace involving a bpf_trampoline function. The triggering context includes detaching an fexit BPF program while another sleepable fexit program in the same trampoline image is still running.