EUVD-2026-59485
GHSA-rqq6-3pqg-qxx2
Severity by source
Sources disagree (Low–High)AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local access with elevated BPF capability (AC:H, PR:L); demonstrated impact is kernel crash only, with no confirmed confidentiality or integrity compromise.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
bpf: Reject sleepable BPF_LSM_CGROUP programs at load time
The cgroup shim runs under rcu_read_lock_dont_migrate(), so we should not attach any sleepable BPF programs there. Add support to the verifier to explicitly reject attempts to load sleepable BPF programs destined for LSM cgroup attachment.
Without this, we get the following splat from a BPF_LSM_CGROUP program marked BPF_F_SLEEPABLE attached to file_open when it calls bpf_get_dentry_xattr():
BUG: sleeping function called from invalid context at kernel/locking/rwsem.c:1567 in_atomic(): 0, irqs_disabled(): 0, non_block: 0, pid: 34317, name: load preempt_count: 0, expected: 0 RCU nest depth: 2, expected: 0 Call Trace: down_read+0x76/0x480 ext4_xattr_get+0x11f/0x700 __vfs_getxattr+0xf0/0x150 bpf_get_dentry_xattr+0xbb/0xf0 bpf_prog_e76a298dac9218c6_test_open+0x6a/0x85 __cgroup_bpf_run_lsm_current+0x326/0x840 bpf_trampoline_6442534646+0x62/0x14d security_file_open+0x34/0x60 do_dentry_open+0x340/0x1260 vfs_open+0x7a/0x440 path_openat+0x1bac/0x30a0
libbpf provides a .s named section variant for every sleepable program type except lsm_cgroup, reflecting that per-cgroup LSM programs are intended to only run in a non-sleepable context.
The above splat was obtained by bypassing libbpf by using bpf(2) directly.
AnalysisAI
Sleepable BPF_LSM_CGROUP programs can be loaded into the Linux kernel without verifier rejection, causing a kernel BUG when those programs invoke blocking helpers inside an RCU read-side critical section. The cgroup BPF shim runs under rcu_read_lock_dont_migrate(), which prohibits sleeping; if a program marked BPF_F_SLEEPABLE attaches to an LSM cgroup hook such as file_open and calls bpf_get_dentry_xattr(), the kernel triggers a 'sleeping function called from invalid context' BUG. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a local account with CAP_BPF (or CAP_SYS_ADMIN) capability, which grants permission to load BPF programs via the bpf(2) syscall. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) sets the ceiling for this vulnerability, but several signals justify downward pressure on real-world prioritization. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local user with CAP_BPF capability issues a bpf(2) syscall directly - bypassing libbpf's lsm_cgroup sleepable guard - to load a BPF_LSM_CGROUP program marked BPF_F_SLEEPABLE attached to the file_open hook. When any process on the system subsequently opens a file, the cgroup LSM shim invokes the sleepable program inside an RCU critical section; the program calls bpf_get_dentry_xattr(), which attempts to acquire an rwsem, triggering a kernel BUG and system crash. … |
| Remediation | The primary fix is to upgrade to Linux kernel 7.1.5 (stable) or Linux 7.2-rc1 (mainline), which add a verifier check that explicitly rejects BPF_LSM_CGROUP programs marked BPF_F_SLEEPABLE at load time. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify Linux kernel versions across infrastructure and validate exposure using the vendor advisory. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Authentication Bypass
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today