CVE-2026-90299

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix sleepable check for tracing/lsm prog

When CONFIG_FUNCTION_ERROR_INJECTION is disabled, a sleepable tracing prog

is allowed to attach to '__x64_'-alike prefix symbols.

It is because the verifier does not verify whether the symbol is a kernel

function or a bpf prog. That said, a sleepable tracing prog is allowed to

attach to a bpf prog target whose name has '__x64_'-alike prefix.

For example, a sleepable fentry prog attaches to a '__x64_sys_nop' XDP

prog, and copies buffer from a user pointer with bpf_copy_from_user()

helper. After attaching the XDP prog to lo interface, the kernel BUG

could be triggered by 'ping -c 1 -W 1 127.0.0.1':

[ 3.460756] BUG: sleeping function called from invalid context at kernel/bpf/trampoline.c:1324

Fix it by disallowing sleepable prog always when its target

btf is not a kernel's btf.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References