UBUNTU-CVE-2026-74338: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: bpf: Reject sleepable BPFLSMCGROUP programs at load time The cgroup shim runs under rcureadlockdontmigrate(), so we should not attach any sleepable BPF programs there. Add support to the verifier to explicitly reject attempts to load sleepable BPF programs destined for LSM cgroup attachment. Without this, we get the following splat from a BPFLSMCGROUP program marked BPFFSLEEPABLE attached to fileopen when it calls bpfgetdentryxattr(): BUG: sleeping function called from invalid context at kernel/locking/rwsem.c:1567 inatomic(): 0, irqsdisabled(): 0, nonblock: 0, pid: 34317, name: load preemptcount: 0, expected: 0 RCU nest depth: 2, expected: 0 Call Trace: downread+0x76/0x480 ext4xattrget+0x11f/0x700 vfsgetxattr+0xf0/0x150 bpfgetdentryxattr+0xbb/0xf0 bpfproge76a298dac9218c6testopen+0x6a/0x85 cgroupbpfrunlsmcurrent+0x326/0x840 bpftrampoline6442534646+0x62/0x14d securityfileopen+0x34/0x60 dodentryopen+0x340/0x1260 vfsopen+0x7a/0x440 pathopenat+0x1bac/0x30a0 libbpf provides a .s named section variant for every sleepable program type except lsmcgroup, reflecting that per-cgroup LSM programs are intended to only run in a non-sleepable context. The above splat was obtained by bypassing libbpf by using bpf(2) directly.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-aws-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-fde-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1016.16~24.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-38.38~24.04.4 - Upgrade
Upgrade
ubuntu/linux-nvidia-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1024.25~24.04.1 - Upgrade
Upgrade
ubuntu/linux-nvidia-tegrato a version that resolves this vulnerability.Fixed in 6.8.0-1036.39 - Upgrade
Upgrade
ubuntu/linux-oracle-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1013.13~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-38.38 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 7.0.0-1016.16 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 7.0.0-1008.9 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-nvidia-bosto a version that resolves this vulnerability.Fixed in 7.0.0-2022.23 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1013.13 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Exposure requires the ability to load and attach a sleepable BPF program to an LSM cgroup hook. The supplied CVSS vector indicates local access and high privileges are required; no user interaction is needed.
What must an attacker-controlled program do to trigger the problem?
A sleepable BPF_LSM_CGROUP program must be attached to an LSM cgroup attachment point and invoke an operation that can sleep. The reported example attaches to file_open and calls bpf_get_dentry_xattr(), which reaches a sleeping lock operation while the cgroup shim is under RCU protection.
What is the expected impact if the vulnerable program is loaded?
The described result is a kernel BUG warning for a sleeping function called from an invalid context. The provided severity vector indicates availability impact is high, while confidentiality and integrity impact are not indicated.
How does the fix prevent this condition?
The verifier rejects attempts to load sleepable BPF programs intended for LSM cgroup attachment. This prevents the incompatible program type from being attached to the cgroup shim context.