In the Linux kernel, the following vulnerability has been resolved:
bpf: Add preempt_count_{sub,add} into btf id deny list
The recursion check in __bpf_prog_enter* and __bpf_prog_exit* leave preempt_count_{sub,add} unprotected. When attaching trampoline to them we get panic as follows,
[ 867.843050] BUG: TASK stack guard page was hit at 0000000009d325cf (stack is 0000000046a46a15..00000000537e7b28) [ 867.843064] stack guard page: 0000 [#1] PREEMPT SMP NOPTI [ 867.843067] CPU: 8 PID: 11009 Comm: trace Kdump: loaded Not tainted 6.2.0+ #4 [ 867.843100] Call Trace: [ 867.843101] <TASK> [ 867.843104] asm_exc_int3+0x3a/0x40 [ 867.843108] RIP: 0010:preempt_count_sub+0x1/0xa0 [ 867.843135] __bpf_prog_enter_recur+0x17/0x90 [ 867.843148] bpf_trampoline_6442468108_0+0x2e/0x1000 [ 867.843154] ? preempt_count_sub+0x1/0xa0 [ 867.843157] preempt_count_sub+0x5/0xa0 [ 867.843159] ? migrate_enable+0xac/0xf0 [ 867.843164] __bpf_prog_exit_recur+0x2d/0x40 [ 867.843168] bpf_trampoline_6442468108_0+0x55/0x1000 ... [ 867.843788] preempt_count_sub+0x5/0xa0 [ 867.843793] ? migrate_enable+0xac/0xf0 [ 867.843829] __bpf_prog_exit_recur+0x2d/0x40 [ 867.843837] BUG: IRQ stack guard page was hit at 0000000099bd8228 (stack is 00000000b23e2bc4..000000006d95af35) [ 867.843841] BUG: IRQ stack guard page was hit at 000000005ae07924 (stack is 00000000ffd69623..0000000014eb594c) [ 867.843843] BUG: IRQ stack guard page was hit at 00000000028320f0 (stack is 00000000034b6438..0000000078d1bcec) [ 867.843842] bpf_trampoline_6442468108_0+0x55/0x1000 ...
That is because in __bpf_prog_exit_recur, the preempt_count_{sub,add} are called after prog->active is decreased.
Fixing this by adding these two functions into btf ids deny list.
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-debuginfo-common-x86_64Upgrade bpftoolUpgrade kernel-toolsUpgrade python-perfUpgrade kernel-tools-debuginfoUpgrade kernelUpgrade kernel-debuginfoUpgrade bpftool-debuginfoUpgrade kernel-livepatch-5.15.117-72.142Upgrade kernel-tools-develUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-headersUpgrade perf-debuginfoUpgrade kernel-develUpgrade perfUpgrade python-perf-debuginfo | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade kernel-headersUpgrade kernel-toolsUpgrade perf-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-libbpf-develUpgrade bpftool-debuginfoUpgrade kernelUpgrade kernel-libbpf-staticUpgrade kernel-livepatch-6.1.34-56.100Upgrade kernel-debuginfo-common-aarch64Upgrade kernel-libbpfUpgrade python3-perf-debuginfoUpgrade kernel-develUpgrade perfUpgrade python3-perfUpgrade kernel-tools-develUpgrade kernel-tools-debuginfoUpgrade bpftoolUpgrade kernel-debuginfo | Feb 20, 2026 | Dec 24, 2025 |
| Debian | — | Upgrade linux | Dec 29, 2025 | Dec 29, 2025 |
| Huawei Euleros 2_0_sp12 | — | Upgrade bpftoolUpgrade kernel-toolsUpgrade kernelUpgrade kernel-abi-stablelistsUpgrade python3-perfUpgrade kernel-tools-libs | Mar 17, 2026 | Mar 16, 2026 |
| Huawei Euleros 2_0_sp13 | — | Upgrade kernel-tools-libsUpgrade python3-perfUpgrade kernelUpgrade kernel-abi-stablelistsUpgrade kernel-toolsUpgrade bpftool | Mar 10, 2026 | Mar 10, 2026 |
| Redhat_linux | — | No solution exists | Jul 17, 2026 | Dec 24, 2025 |
| Ubuntu | — | Upgrade linux-hwe-5.15Upgrade linux-nvidiaUpgrade linux-oracleUpgrade linux-raspiUpgrade linux-xilinx-zynqmpUpgrade linux-azureUpgrade linux-aws-5.15Upgrade linux-kvmUpgrade linux-bluefieldUpgrade linux-lowlatency-hwe-5.15Upgrade linux-realtimeUpgrade linux-ibmUpgrade linux-riscv-5.15Upgrade linux-azure-5.15Upgrade linux-oracle-5.15Upgrade linux-intel-iotg-5.15Upgrade linux-gcpUpgrade linux-intel-iotgUpgrade linux-gcp-5.15Upgrade linux-awsUpgrade linux-nvidia-tegraUpgrade linux-azure-fde-5.15Upgrade linux-gkeopUpgrade linuxUpgrade linux-ibm-5.15Upgrade linux-nvidia-tegra-5.15Upgrade linux-intel-iot-realtimeUpgrade linux-lowlatencyUpgrade linux-nvidia-tegra-igxUpgrade linux-gke | Jan 6, 2026 | Dec 24, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub