CVE-2026-89991

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix infinite loop in pcpu_freelist push with one possible CPU

__pcpu_freelist_push() can loop forever when only one CPU is possible

and an NMI re-enters pcpu_freelist_push() while the interrupted context

holds that CPU's freelist lock.

After the current-CPU fast path fails, the fallback loop walks

cpu_possible_mask while skipping the current CPU. With CONFIG_SMP=n, or

when an SMP kernel is limited to one possible CPU with nr_cpus=1 or

possible_cpus=1, there are no other possible CPUs to examine. The loop

therefore makes no lock acquisition attempt and can never make progress.

The following stack was observed on a UP system:

NMI context:

pcpu_freelist_push

free_htab_elem

htab_map_delete_elem

[perf-event BPF program]

__perf_event_overflow

perf_event_nmi_handler

exc_nmi

Interrupted context:

__pcpu_freelist_push

pcpu_freelist_push

free_htab_elem

htab_map_delete_ele

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References