CVE-2026-43010
BPF kprobe_multi Program Sleepable Context Bypass
Publication date: 2026-05-01
Last updated on: 2026-05-01
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's handling of bpf kprobe_multi programs. Specifically, kprobe.multi programs run in atomic or RCU context and are not allowed to sleep. However, the function bpf_kprobe_multi_link_attach() did not check if the program being attached was marked as sleepable. This allowed sleepable helpers, such as bpf_copy_from_user(), to be called from a non-sleepable context, which is invalid.
As a result, this causes a kernel error known as a "sleeping function called from invalid context" bug, which can lead to system instability or crashes.
The fix involves rejecting sleepable programs early during the attachment process to prevent this invalid state.
How can this vulnerability impact me? :
This vulnerability can cause the Linux kernel to crash or become unstable due to the invocation of sleeping functions in contexts where sleeping is not allowed. This can lead to system errors, unexpected behavior, or denial of service conditions on affected systems.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability causes a kernel BUG triggered by a sleeping function being called from an invalid context. Detection can be done by monitoring kernel logs for the specific error message:
- Look for the log entry: "BUG: sleeping function called from invalid context at ./include/linux/uaccess.h:169"
- Check kernel logs using commands such as: dmesg | grep 'sleeping function called from invalid context'
- Monitor for processes triggering this, e.g., the example shows 'pid: 1787, name: sudo'
What immediate steps should I take to mitigate this vulnerability?
The vulnerability is fixed by rejecting sleepable kprobe_multi BPF programs at attach time. Immediate mitigation steps include:
- Update the Linux kernel to a version that includes the fix for this vulnerability.
- Avoid attaching sleepable BPF kprobe_multi programs until the kernel is updated.
- Monitor kernel logs for the specific BUG message to detect exploitation attempts.