UBUNTU-CVE-2026-98058: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: bpf: Mark syscall helpers as sleepable bpfsysbpf() executes the bpf(2) syscall body, which can take mutexes, allocate with GFPKERNEL, and wait for an RCU grace period. bpfsysclose() reaches closefd() and filpclose(), which can sleep as well. Both helpers are limited to BPFPROGTYPESYSCALL, whose main program is sleepable. That does not make every callback sleepable: a syscall program can register a bpftimer callback, and the verifier checks that callback in a non-sleepable context while retaining the syscall helper set. Without .mightsleep on the prototypes, such a callback can invoke bpfsysbpf() from hrtimer softirq context and trigger a scheduling-while-atomic failure. bpfsysclose() is exposed through the same missing context check. Set .mightsleep on both prototypes so the existing helper-context check rejects them from timer callbacks and other atomic regions. Calls from the sleepable main body remain valid.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
Who can trigger this issue?
The vector is local and requires high privileges. The vulnerable path involves BPF_PROG_TYPE_SYSCALL programs that retain syscall helpers in callbacks checked as non-sleepable.
What BPF code should be audited?
Audit syscall BPF programs that register bpf_timer callbacks or otherwise invoke helpers from atomic, non-sleepable contexts. The relevant helpers are bpf_sys_bpf() and bpf_sys_close().
What is the likely impact of successful triggering?
Calling bpf_sys_bpf() from an hrtimer softirq context can cause a scheduling-while-atomic failure because the helper can sleep. bpf_sys_close() has the same missing context check and can also reach sleepable operations.
Are calls to these helpers always rejected after the fix?
No. The fix marks the helpers as potentially sleeping so existing helper-context checks reject them in timer callbacks and other atomic regions. Calls from the sleepable main body of a BPF_PROG_TYPE_SYSCALL program remain valid.