CVE-2026-93173

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf,lsm: Drop bpf_prog_free from sleepable_lsm_hooks

__bpf_prog_put_rcu() is the call_rcu() callback for non-sleepable programs.

security_bpf_prog_free() called from there fires bpf_prog_free in softirq;

if a sleepable LSM prog is attached to that hook, might_fault() BUGs:

BUG: sleeping function called from invalid context

in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 5038

preempt_count: 101, expected: 0

Call Trace:

<IRQ>

__bpf_prog_enter_sleepable+0x1cd/0x320 kernel/bpf/trampoline.c:1255

bpf_trampoline_6442549705+0x53/0xd7

security_bpf_prog_free+0xde/0x130 security/security.c:5465

__bpf_prog_put_rcu+0xab/0xd0 kernel/bpf/syscall.c:2365

rcu_do_batch kernel/rcu/tree.c:2617 [inline]

handle_softirqs+0x236/0x800 kernel/softirq.c:622

</IRQ>

The call_rcu/call_rcu_tasks_trace split reflects the freed program's

sleepability, not that of any attached observer.

security_bpf_prog_free(

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References