CVE-2026-98058

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Mark syscall helpers as sleepable

bpf_sys_bpf() executes the bpf(2) syscall body, which can take mutexes,

allocate with GFP_KERNEL, and wait for an RCU grace period.

bpf_sys_close() reaches close_fd() and filp_close(), which can sleep as

well.

Both helpers are limited to BPF_PROG_TYPE_SYSCALL, whose main program is

sleepable. That does not make every callback sleepable: a syscall program

can register a bpf_timer callback, and the verifier checks that callback

in a non-sleepable context while retaining the syscall helper set.

Without .might_sleep on the prototypes, such a callback can invoke

bpf_sys_bpf() from hrtimer softirq context and trigger a

scheduling-while-atomic failure. bpf_sys_close() is exposed through the

same missing context check.

Set .might_sleep on both prototypes so the existing helper-context check

rejects them from timer callbacks and other atomic regions. Calls from the

sleepable main body

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References