CVE-2026-74337

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix NMI/tracepoint re-entry deadlock on lru locks

NMI and tracepoint BPF programs can re-enter the per-CPU or global

LRU lock that bpf_lru_pop_free()/push_free() already hold on the

same CPU, AA-deadlocking. Lockdep reports "inconsistent

{INITIAL USE} -> {IN-NMI}" on &l->lock (syzbot c69a0a2c816716f1e0d5)

and "possible recursive locking detected" on &loc_l->lock (syzbot

18b26edb69b2e19f3b33).

Prior trylock and rqspinlock based fixes (see links) were nacked

because compromised on reliability.

This patch converts every LRU lock site to rqspinlock_t and adds a

recovery path for some failure windows to avoid node leaks.

Failure recovery:

- *_pop_free top-level: return NULL; prealloc_lru_pop() already

treats that as no-free-element (-ENOMEM).

- Cross-CPU steal: skip the victim's locked loc_l, try next CPU.

- Post-steal local lock fail: publish stolen node to lockless

per-CPU free_llist; next pop on thi

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References