CVE-2026-90342

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix mmap_lock deadlock on arena lock failure

Reported by the Sashiko AI review.

arena_vm_fault() returns VM_FAULT_RETRY when it can't take

arena->spinlock, but it never took mmap_lock. The fault path assumes a

VM_FAULT_RETRY handler already dropped mmap_lock and re-takes it on the

retry, so mmap_lock gets taken twice and can deadlock:

do_user_addr_fault()

{

fault = handle_mm_fault(...); // calls arena_vm_fault()

if (fault & VM_FAULT_RETRY)

goto retry; // re-locks mmap_lock

mmap_read_unlock(mm);

}

Return VM_FAULT_SIGBUS instead, for two reasons:

1. We could keep VM_FAULT_RETRY, but then we'd have to drop the fault

lock first and cap the retry ourselves, the way __folio_lock_or_retry()

does.

2. A failed raw_res_spin_lock_irqsave() already means a possible deadlock

was detected, so retrying just hits the same lock again.

So returning VM_FAULT_RETRY here is overkill.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References