CVE-2026-98058: Linux Kernel BPF Race Condition Vulnerability

CVE-2026-98058 Overview

CVE-2026-98058 is a Linux kernel vulnerability in the Berkeley Packet Filter (BPF) subsystem. The flaw affects the bpf_sys_bpf() and bpf_sys_close() helpers, which are exposed to BPF_PROG_TYPE_SYSCALL programs. Both helpers perform operations that can sleep, including taking mutexes, allocating memory with GFP_KERNEL, and waiting for Read-Copy-Update (RCU) grace periods. Because their prototypes were missing the .might_sleep annotation, the BPF verifier allowed these helpers to be invoked from non-sleepable callback contexts such as bpf_timer callbacks running in hrtimer softirq context. Invocation from an atomic region triggers a scheduling-while-atomic kernel failure.

Critical Impact
A local user capable of loading a BPF syscall program can register a timer callback that calls sleepable helpers from softirq context, leading to a kernel scheduling-while-atomic condition and potential denial of service.

Affected Products

Linux kernel versions containing the sleepable BPF syscall helpers prior to commit d05524794240
Linux kernel stable branches prior to the backported fix 3408e98f06ce
Distributions shipping affected mainline kernel versions with BPF_PROG_TYPE_SYSCALL enabled

Discovery Timeline

2026-09-25 - CVE-2026-98058 published to the National Vulnerability Database
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-98058

Vulnerability Analysis

The vulnerability resides in the BPF syscall helper interface used by BPF_PROG_TYPE_SYSCALL programs. The helper bpf_sys_bpf() executes the body of the bpf(2) syscall, which can acquire mutexes, perform GFP_KERNEL allocations, and synchronize on RCU grace periods. The companion helper bpf_sys_close() descends into close_fd() and filp_close(), both of which may sleep. Although the main program of a syscall-type BPF program runs in a sleepable context, that property does not propagate to every callback the program registers. A syscall program can install a bpf_timer callback, and the BPF verifier evaluates such callbacks in a non-sleepable context while still permitting the full set of syscall helpers. The absence of .might_sleep on the helper prototypes meant the verifier's helper-context check could not reject these calls when a timer callback invoked them from hrtimer softirq context, producing a scheduling-while-atomic kernel bug.

Root Cause

The root cause is a missing .might_sleep flag on the bpf_sys_bpf and bpf_sys_close helper prototypes. Without this annotation, the verifier's context-sensitivity check did not treat these helpers as sleepable, so it allowed them inside callbacks that run in atomic regions.

Attack Vector

Exploitation requires the ability to load a BPF syscall program, which typically requires CAP_BPF or CAP_SYS_ADMIN. An attacker with these privileges can author a syscall program that registers a bpf_timer callback invoking bpf_sys_bpf() or bpf_sys_close(). When the hrtimer fires in softirq context, the callback invokes a sleepable operation, producing a scheduling-while-atomic failure that destabilizes the kernel.

// No verified exploit code is available. See the upstream commits
// 3408e98f06ce and d05524794240 for the fix that adds .might_sleep
// to the bpf_sys_bpf and bpf_sys_close helper prototypes.

Detection Methods for CVE-2026-98058

Indicators of Compromise

Kernel log entries containing BUG: scheduling while atomic originating from BPF helper call paths
Softirq backtraces referencing bpf_sys_bpf, bpf_sys_close, close_fd, or filp_close within hrtimer execution
Unexpected kernel panics or soft lockups coinciding with loading of BPF_PROG_TYPE_SYSCALL programs

Detection Strategies

Audit loaded BPF programs for BPF_PROG_TYPE_SYSCALL that register bpf_timer callbacks invoking syscall helpers
Collect dmesg output across the fleet and alert on scheduling-while-atomic traces that reference BPF helper symbols
Monitor bpf() syscall activity for untrusted principals holding CAP_BPF or CAP_SYS_ADMIN

Monitoring Recommendations

Centralize kernel ring buffer logs and parse for atomic-context violations tied to BPF subsystems
Track installation of new BPF programs through bpftool prog show snapshots or audit events
Baseline kernel versions across hosts to confirm patched builds are deployed consistently

How to Mitigate CVE-2026-98058

Immediate Actions Required

Apply the upstream fix contained in kernel commits 3408e98f06ce and d05524794240 or the equivalent stable backport
Restrict CAP_BPF and CAP_SYS_ADMIN to trusted administrative accounts and workloads
Reboot affected hosts after kernel updates to activate the patched BPF verifier

Patch Information

The fix sets .might_sleep on the bpf_sys_bpf and bpf_sys_close helper prototypes so the verifier's existing helper-context check rejects them from timer callbacks and other atomic regions. Calls from sleepable main program bodies remain valid. Patch details are available in the kernel git commit (3408e98f06ce) and the kernel git commit (d05524794240).

Workarounds

Disable BPF_PROG_TYPE_SYSCALL program loading on hosts that do not require it by tightening BPF-related capabilities
Enforce kernel.unprivileged_bpf_disabled=1 to prevent unprivileged BPF program loading
Use Linux Security Modules such as SELinux or AppArmor to restrict which processes may invoke bpf(2)

bash

# Disable unprivileged BPF program loading
sysctl -w kernel.unprivileged_bpf_disabled=1
echo 'kernel.unprivileged_bpf_disabled=1' >> /etc/sysctl.d/90-bpf-hardening.conf