CVE-2026-98058
Received Received - Intake

BaseFortify

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: bpf: Mark syscall helpers as sleepable bpf_sys_bpf() executes the bpf(2) syscall body, which can take mutexes, allocate with GFP_KERNEL, and wait for an RCU grace period. bpf_sys_close() reaches close_fd() and filp_close(), which can sleep as well. Both helpers are limited to BPF_PROG_TYPE_SYSCALL, whose main program is sleepable. That does not make every callback sleepable: a syscall program can register a bpf_timer callback, and the verifier checks that callback in a non-sleepable context while retaining the syscall helper set. Without .might_sleep on the prototypes, such a callback can invoke bpf_sys_bpf() from hrtimer softirq context and trigger a scheduling-while-atomic failure. bpf_sys_close() is exposed through the same missing context check. Set .might_sleep on both prototypes so the existing helper-context check rejects them from timer callbacks and other atomic regions. Calls from the sleepable main body remain valid.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-98058
EUVD
EUVD-2026-86711

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the Linux kernel's BPF (Berkeley Packet Filter) subsystem. It involves two syscall helpers, bpf_sys_bpf() and bpf_sys_close(), which can sleep or take mutexes but were not marked as sleepable. This allows them to be called from non-sleepable contexts like timer callbacks, potentially causing scheduling-while-atomic failures.

Detection Guidance

This vulnerability is specific to the Linux kernel's BPF subsystem and requires kernel-level detection. There are no direct network or system commands to detect it as it involves a missing .might_sleep annotation in kernel code. Monitoring kernel logs for scheduling-while-atomic errors may indicate exploitation attempts.

Impact Analysis

If exploited, this vulnerability could cause system crashes or instability by triggering scheduling-while-atomic errors. It primarily affects systems using BPF programs with timer callbacks, potentially leading to denial-of-service conditions.

Mitigation Strategies

Apply the latest Linux kernel patches that include the fix for this vulnerability. Update your system to a kernel version where bpf_sys_bpf() and bpf_sys_close() have .might_sleep annotations. Reboot the system after applying the patch.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98058. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart