CVE-2026-98046
Received Received - Intake

BPF Helper Sleepable Due to BTF Type Lookup

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: bpf: Mark bpf_btf_find_by_name_kind() as sleepable When bpf_btf_find_by_name_kind() finds a type in module BTF, it returns a new BTF object fd through __btf_new_fd(). This reaches anon_inode_getfd(), which can sleep while allocating or expanding the current task fd table. The helper prototype does not set might_sleep, so the verifier allows the helper in non-sleepable contexts such as BPF timer callbacks. The fd allocation can then sleep in softirq context and install the fd into the interrupted task. Mark the helper as sleepable. This preserves calls from the main body of a sleepable syscall program while rejecting calls from its non-sleepable regions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-98046
EUVD
EUVD-2026-86699

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves a Linux kernel issue where the bpf_btf_find_by_name_kind() function can sleep during fd allocation while in softirq context. The helper function lacks the might_sleep annotation, allowing it to be called in non-sleepable contexts like BPF timer callbacks, which can lead to unexpected behavior or crashes.

Detection Guidance

This vulnerability is specific to the Linux kernel's BPF (Berkeley Packet Filter) subsystem and requires kernel-level inspection. Detection involves checking kernel logs for BPF-related errors or verifying if the vulnerable function bpf_btf_find_by_name_kind() is being called in non-sleepable contexts like BPF timer callbacks.

Impact Analysis

This vulnerability may cause system instability or crashes if exploited in softirq context. It could lead to denial-of-service conditions or unexpected behavior in BPF programs, particularly those using timer callbacks.

Mitigation Strategies

Update your Linux kernel to a patched version where bpf_btf_find_by_name_kind() is marked as sleepable. This prevents the issue by ensuring the helper is only called in sleepable contexts. Check your distribution's security advisories for kernel updates addressing this CVE.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98046. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart