CVE-2026-23134: Linux Kernel Privilege Escalation Flaw

CVE-2026-23134 Overview

A vulnerability has been identified in the Linux kernel's SLAB memory allocator where the kmalloc_nolock() function performs an incomplete context check on PREEMPT_RT (Real-Time) kernels. On these kernels, local_lock becomes a sleeping lock, but the current validation only verifies the execution context is not within NMI or hard IRQ handlers, missing the critical case where preemption is disabled.

When a BPF program executes from a tracepoint with preemption disabled (preempt_count > 0), kmalloc_nolock() proceeds to call local_lock_irqsave(), which attempts to acquire a sleeping lock in an atomic context. This triggers a kernel BUG with the message "sleeping function called from invalid context."

Critical Impact

This vulnerability can cause kernel instability and crashes when BPF programs interact with the SLAB allocator on PREEMPT_RT kernels, potentially leading to denial of service conditions.

Affected Products

• Linux kernel with PREEMPT_RT configuration enabled
• Systems running BPF programs from tracepoints with preemption disabled
• Linux kernel SLAB memory allocator subsystem

Discovery Timeline

• 2026-02-14 - CVE CVE-2026-23134 published to NVD
• 2026-02-18 - Last updated in NVD database

Technical Details for CVE-2026-23134

Vulnerability Analysis

The vulnerability exists in the kmalloc_nolock() function within the Linux kernel's SLAB allocator. On standard kernels, local_lock is implemented as a lightweight locking primitive that doesn't sleep. However, on PREEMPT_RT kernels, local_lock is converted to a sleeping lock to support real-time scheduling guarantees.

The existing context check in kmalloc_nolock() validates that the code is not executing in NMI or hard IRQ context, but fails to account for scenarios where preemption is simply disabled (preempt_count > 0). This oversight means that when a BPF program runs from a tracepoint with preemption disabled, the function incorrectly proceeds to acquire the sleeping lock.

The kernel reports this condition with the following diagnostic information:

• in_atomic(): 1 - indicating atomic context
• preempt_count: 2 - showing preemption is disabled
• expected: 0 - the expected preempt_count for a sleeping operation

Root Cause

The root cause is an incomplete predicate in the kmalloc_nolock() context validation logic. The check was designed for non-PREEMPT_RT kernels where local_lock operations don't require sleeping capability. When the kernel is compiled with PREEMPT_RT, the semantics of local_lock_irqsave() change fundamentally, but the context check was not updated to reflect this constraint.

The fix requires checking !preemptible() on PREEMPT_RT kernels, which directly expresses the constraint that sleeping locks cannot be acquired when preemption is disabled. This check encompasses the previous NMI and hard IRQ context validations while also catching preemption-disabled scenarios.

Attack Vector

The vulnerability is triggered through normal kernel operations when the following conditions are met:

1. The system is running a Linux kernel compiled with PREEMPT_RT support
2. A BPF program is attached to a tracepoint
3. The BPF program executes while preemption is disabled (preempt_count > 0)
4. The BPF program's execution path calls into kmalloc_nolock()

When these conditions align, the kernel attempts to acquire a sleeping lock in an atomic context, resulting in a BUG condition that can crash the system or cause unpredictable behavior. This is primarily a local denial of service vector that requires the ability to load BPF programs on the target system.

Detection Methods for CVE-2026-23134

Indicators of Compromise

• Kernel panic or BUG messages containing "sleeping function called from invalid context"
• Kernel log entries showing in_atomic(): 1 with preempt_count values greater than 0
• System crashes or hangs occurring specifically on PREEMPT_RT kernels
• BPF program execution failures coinciding with tracepoint activity

Detection Strategies

• Monitor kernel logs (dmesg, /var/log/kern.log) for "sleeping function called from invalid context" messages
• Implement kernel crash monitoring to detect BUG conditions in the SLAB allocator subsystem
• Use SentinelOne's kernel-level visibility to track anomalous memory allocation patterns on PREEMPT_RT systems
• Deploy monitoring for unexpected system reboots or kernel panics on real-time systems

Monitoring Recommendations

• Enable kernel debug logging on PREEMPT_RT systems to capture context violation warnings
• Implement automated alerting for kernel BUG conditions in production environments
• Monitor BPF program loading and execution on systems with real-time kernel configurations
• Use crash dump analysis tools to identify SLAB allocator failures in post-mortem analysis

How to Mitigate CVE-2026-23134

Immediate Actions Required

• Apply the kernel patches provided in the official kernel git commits
• If patching is not immediately possible, consider temporarily disabling BPF programs that run from tracepoints on affected PREEMPT_RT systems
• Review and audit BPF programs for tracepoint usage patterns that may trigger this condition
• Monitor systems for kernel crashes while awaiting patch deployment

Patch Information

The fix has been merged into the stable kernel tree. The patches modify the kmalloc_nolock() function to check !preemptible() on PREEMPT_RT kernels, properly expressing the constraint that sleeping locks cannot be acquired when preemption is disabled.

Official patches are available:

• Kernel Git Commit 99a3e3a1
• Kernel Git Commit f60ba4a9

Workarounds

• Avoid running BPF programs from tracepoints on PREEMPT_RT kernels until the patch is applied
• Consider using a standard (non-PREEMPT_RT) kernel if real-time scheduling is not required
• Temporarily unload BPF programs that may trigger the vulnerable code path
• Implement monitoring to detect and restart services affected by kernel instability

# Check if system is running a PREEMPT_RT kernel
uname -a | grep -i preempt
cat /proc/version | grep -i preempt

# List loaded BPF programs that may be affected
bpftool prog list

# Check kernel configuration for PREEMPT_RT
zcat /proc/config.gz 2>/dev/null | grep CONFIG_PREEMPT_RT || cat /boot/config-$(uname -r) | grep CONFIG_PREEMPT_RT