UBUNTU-CVE-2026-90247: Low severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix mmaplock leak in irqwork path stackmapgetbuildidoffset() introduced a per-CPU irqwork to defer mmapreadunlock() from NMI context, and bpffindvma() later reused the same mmapunlockwork. Both callers only check whether the work is busy before taking mmaplock, so a nested caller can reuse the slot before the first caller queues it. Two read locks may then be acquired while only one deferred unlock runs, leaking a read lock and blocking exitmmap(). Reserve the per-CPU slot before mmapreadtrylock(). Use the same wrapper in stackmap and bpffindvma() so both callers release the reservation on trylock failure. Keep rejecting the slot while the irqwork remains busy. Release it after the irqwork callback unlocks the mm.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In the kernel BPF stackmap and bpf_find_vma paths, reserve the per-CPU irq_work slot before mmap_read_trylock(), keep rejecting the slot while irq_work is busy, and use the same wrapper so both callers release the reservation on trylock failure; release the reservation only after the irq_work callback unlocks the mm.
Event History
Frequently Asked Questions
Which Ubuntu kernel package variants are listed as affected?
The listed packages are ubuntu/linux, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-aws-fips, ubuntu/linux-azure-fips, ubuntu/linux-fips, ubuntu/linux-gcp-fips, and ubuntu/linux-realtime.
What operational impact can result from triggering the issue?
A leaked mmap read lock can block exit_mmap(), preventing the affected memory-management teardown from completing.
What concurrency condition is required to trigger the lock leak?
A nested caller must reuse the same per-CPU deferred-unlock work slot after the first caller has checked that it is not busy but before that caller queues the irq_work. This can result in two read locks being acquired while only one deferred unlock executes.