CVE-2026-43010

Vulnerability

The Linux kernel's BPF subsystem lacked a check in bpf_kprobe_multi_link_attach() to reject programs marked with the sleepable flag. Since kprobe.multi programs execute in atomic/RCU context, they must never invoke helpers that can sleep, such as bpf_copy_from_user(). The missing validation allowed such programs to be attached, leading to a "sleeping function called from invalid context" kernel splat, observed for example at include/linux/uaccess.h:169 [1].

Exploitation

To trigger this issue, an attacker must have the ability to load and attach a BPF program with the BPF_F_SLEEPABLE flag to a kprobe.multi link. This requires either privileged access (typically root or CAP_BPF and CAP_PERFMON) or a pre-existing means to load arbitrary BPF programs. The attack surface is limited to systems where unprivileged BPF is enabled or where a local attacker already has sufficient privileges.

Impact

When a sleepable helper is called from the atomic kprobe context, the kernel may attempt to reschedule or block, which is forbidden. This results in a BUG() splat, causing a kernel panic or a crash depending on the kernel configuration. The immediate consequence is denial of service; under some configurations, it might also allow speculative side-channel information disclosure, though the primary impact is system instability.

Mitigation

The fix is to add a check in bpf_kprobe_multi_link_attach() to reject any program that has the BPF_F_SLEEPABLE flag. The patch has been applied to the stable kernel branches [1][2][3]. Administrators should apply the updated kernel or backport the commit to their running kernel. No workaround is available other than restricting BPF program loading to trusted users.