In the Linux kernel, the following vulnerability has been resolved:
bpf: Add preempt_count_{sub,add} into btf id deny list
The recursion check in __bpf_prog_enter* and __bpf_prog_exit* leave preempt_count_{sub,add} unprotected. When attaching trampoline to them we get panic as follows,
[ 867.843050] BUG: TASK stack guard page was hit at 0000000009d325cf (stack is 0000000046a46a15..00000000537e7b28) [ 867.843064] stack guard page: 0000 [#1] PREEMPT SMP NOPTI [ 867.843067] CPU: 8 PID: 11009 Comm: trace Kdump: loaded Not tainted 6.2.0+ #4 [ 867.843100] Call Trace: [ 867.843101] <TASK> [ 867.843104] asm_exc_int3+0x3a/0x40 [ 867.843108] RIP: 0010:preempt_count_sub+0x1/0xa0 [ 867.843135] __bpf_prog_enter_recur+0x17/0x90 [ 867.843148] bpf_trampoline_6442468108_0+0x2e/0x1000 [ 867.843154] ? preempt_count_sub+0x1/0xa0 [ 867.843157] preempt_count_sub+0x5/0xa0 [ 867.843159] ? migrate_enable+0xac/0xf0 [ 867.843164] __bpf_prog_exit_recur+0x2d/0x40 [ 867.843168] bpf_trampoline_6442468108_0+0x55/0x1000 ... [ 867.843788] preempt_count_sub+0x5/0xa0 [ 867.843793] ? migrate_enable+0xac/0xf0 [ 867.843829] __bpf_prog_exit_recur+0x2d/0x40 [ 867.843837] BUG: IRQ stack guard page was hit at 0000000099bd8228 (stack is 00000000b23e2bc4..000000006d95af35) [ 867.843841] BUG: IRQ stack guard page was hit at 000000005ae07924 (stack is 00000000ffd69623..0000000014eb594c) [ 867.843843] BUG: IRQ stack guard page was hit at 00000000028320f0 (stack is 00000000034b6438..0000000078d1bcec) [ 867.843842] bpf_trampoline_6442468108_0+0x55/0x1000 ...
That is because in __bpf_prog_exit_recur, the preempt_count_{sub,add} are called after prog->active is decreased.
Fixing this by adding these two functions into btf ids deny list.
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade python-perfUpgrade kernel-debuginfoUpgrade bpftool-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-tools-debuginfoUpgrade kernelUpgrade bpftoolUpgrade kernel-toolsUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-livepatch-5.15.117-72.142Upgrade kernel-develUpgrade kernel-tools-develUpgrade perf-debuginfoUpgrade python-perf-debuginfoUpgrade perfUpgrade kernel-headers | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade kernel-debuginfo-common-aarch64Upgrade kernel-tools-debuginfoUpgrade bpftoolUpgrade perfUpgrade python3-perf-debuginfoUpgrade kernel-develUpgrade python3-perfUpgrade kernel-tools-develUpgrade kernel-livepatch-6.1.34-56.100Upgrade kernel-debuginfoUpgrade kernel-libbpf-staticUpgrade kernel-libbpfUpgrade bpftool-debuginfoUpgrade kernel-libbpf-develUpgrade perf-debuginfoUpgrade kernel-toolsUpgrade kernelUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-headers | Feb 20, 2026 | Dec 24, 2025 |
| Debian | — | Upgrade linux | Dec 29, 2025 | Dec 29, 2025 |
| Huawei Euleros 2_0_sp12 | — | Upgrade kernel-toolsUpgrade bpftoolUpgrade python3-perfUpgrade kernel-abi-stablelistsUpgrade kernelUpgrade kernel-tools-libs | Mar 17, 2026 | Mar 16, 2026 |
| Huawei Euleros 2_0_sp13 | — | Upgrade kernel-tools-libsUpgrade python3-perfUpgrade kernelUpgrade kernel-abi-stablelistsUpgrade bpftoolUpgrade kernel-tools | Mar 10, 2026 | Mar 10, 2026 |
| Redhat_linux | — | No solution exists | Jul 17, 2026 | Dec 24, 2025 |
| Ubuntu | — | Upgrade linux-nvidia-tegraUpgrade linux-azure-fde-5.15Upgrade linux-gkeUpgrade linux-lowlatencyUpgrade linux-gkeopUpgrade linux-awsUpgrade linuxUpgrade linux-nvidia-tegra-igxUpgrade linux-intel-iot-realtimeUpgrade linux-ibm-5.15Upgrade linux-nvidia-tegra-5.15Upgrade linux-ibmUpgrade linux-intel-iotg-5.15Upgrade linux-oracleUpgrade linux-azureUpgrade linux-nvidiaUpgrade linux-xilinx-zynqmpUpgrade linux-raspiUpgrade linux-bluefieldUpgrade linux-lowlatency-hwe-5.15Upgrade linux-realtimeUpgrade linux-azure-5.15Upgrade linux-intel-iotgUpgrade linux-riscv-5.15Upgrade linux-gcpUpgrade linux-kvmUpgrade linux-aws-5.15Upgrade linux-hwe-5.15Upgrade linux-oracle-5.15Upgrade linux-gcp-5.15 | Jan 6, 2026 | Dec 24, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub