CVE-2026-64352

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Allow LPM map access from sleepable BPF programs

trie_lookup_elem() annotates its rcu_dereference_check() walks with

only rcu_read_lock_bh_held(). Because rcu_dereference_check(p, c)

resolves to "c || rcu_read_lock_held()", this passes for XDP/NAPI and

classic RCU readers but fails for sleepable BPF programs, which enter

via __bpf_prog_enter_sleepable() and hold only rcu_read_lock_trace().

trie_update_elem() and trie_delete_elem() have the same problem in a

different form: they walk the trie with plain rcu_dereference(), which

asserts rcu_read_lock_held() unconditionally. Both are reachable from

sleepable BPF programs via the bpf_map_update_elem / bpf_map_delete_elem

helpers, and from the syscall path under classic rcu_read_lock(). In

the writer paths the trie is actually protected by trie->lock (an

rqspinlock taken across the walk); we never relied on the RCU read-side

lock to keep nodes alive there.

A sle

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References