In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix deadlock when freeing cgroup storage
The following commit bc235cdb423a ("bpf: Prevent deadlock from recursive bpf_task_storage_[get|delete]") first introduced deadlock prevention for fentry/fexit programs attaching on bpf_task_storage helpers. That commit also employed the logic in map free path in its v6 version.
Later bpf_cgrp_storage was first introduced in c4bcfb38a95e ("bpf: Implement cgroup storage available to non-cgroup-attached bpf progs") which faces the same issue as bpf_task_storage, instead of its busy counter, NULL was passed to bpf_local_storage_map_free() which opened a window to cause deadlock:
<TASK> (acquiring local_storage->lock) _raw_spin_lock_irqsave+0x3d/0x50 bpf_local_storage_update+0xd1/0x460 bpf_cgrp_storage_get+0x109/0x130 bpf_prog_a4d4a370ba857314_cgrp_ptr+0x139/0x170 ? __bpf_prog_enter_recur+0x16/0x80 bpf_trampoline_6442485186+0x43/0xa4 cgroup_storage_ptr+0x9/0x20 (holding local_storage->lock) bpf_selem_unlink_storage_nolock.constprop.0+0x135/0x160 bpf_selem_unlink_storage+0x6f/0x110 bpf_local_storage_map_free+0xa2/0x110 bpf_map_free_deferred+0x5b/0x90 process_one_work+0x17c/0x390 worker_thread+0x251/0x360 kthread+0xd2/0x100 ret_from_fork+0x34/0x50 ret_from_fork_asm+0x1a/0x30 </TASK>
Progs: - A: SEC("fentry/cgroup_storage_ptr") - cgid (BPF_MAP_TYPE_HASH) Record the id of the cgroup the current task belonging to in this hash map, using the address of the cgroup as the map key. - cgrpa (BPF_MAP_TYPE_CGRP_STORAGE) If current task is a kworker, lookup the above hash map using function parameter @owner as the key to get its corresponding cgroup id which is then used to get a trusted pointer to the cgroup through bpf_cgroup_from_id(). This trusted pointer can then be passed to bpf_cgrp_storage_get() to finally trigger the deadlock issue. - B: SEC("tp_btf/sys_enter") - cgrpb (BPF_MAP_TYPE_CGRP_STORAGE) The only purpose of this prog is to fill Prog A's hash map by calling bpf_cgrp_storage_get() for as many userspace tasks as possible.
Steps to reproduce: - Run A; - while (true) { Run B; Destroy B; }
Fix this issue by passing its busy counter to the free procedure so it can be properly incremented before storage/smap locking.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-rt-debug-develUpgrade kernel-uki-virt-addonsUpgrade kernel-zfcpdump-modulesUpgrade kernel-64kUpgrade kernel-zfcpdump-develUpgrade kernel-debug-modules-coreUpgrade kernelUpgrade kernel-64k-debugUpgrade kernel-cross-headersUpgrade kernel-headersUpgrade kernel-tools-libs-develUpgrade kernel-64k-modulesUpgrade kernel-rt-64k-debugUpgrade kernel-rt-debug-coreUpgrade kernel-abi-stablelistsUpgrade kernel-64k-devel-matchedUpgrade kernel-zfcpdumpUpgrade kernel-rtUpgrade kernel-rt-modules-extraUpgrade kernel-64k-debug-modules-extraUpgrade kernel-rt-64k-modules-extraUpgrade kernel-zfcpdump-coreUpgrade kernel-debug-modules-extraUpgrade kernel-rt-64k-debug-coreUpgrade kernel-rt-64k-coreUpgrade kernel-rt-64k-debug-modules-extraUpgrade kernel-rt-64k-modules-coreUpgrade kernel-rt-64k-debug-modulesUpgrade kernel-devel-matchedUpgrade kernel-rt-modules-coreUpgrade kernel-rt-debug-modulesUpgrade kernel-64k-debug-coreUpgrade kernel-debug-develUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-debug-devel-matchedUpgrade libperfUpgrade kernel-debug-modulesUpgrade kernel-tools-libsUpgrade kernel-64k-coreUpgrade kernel-modules-coreUpgrade kernel-uki-virtUpgrade kernel-coreUpgrade kernel-rt-64k-develUpgrade kernel-rt-64kUpgrade kernel-rt-64k-modulesUpgrade kernel-64k-debug-develUpgrade kernel-toolsUpgrade kernel-rt-debugUpgrade kernel-docUpgrade perfUpgrade kernel-64k-modules-extraUpgrade kernel-64k-debug-devel-matchedUpgrade kernel-64k-develUpgrade kernel-debugUpgrade kernel-rt-64k-debug-modules-coreUpgrade kernel-debug-uki-virtUpgrade kernel-modulesUpgrade kernel-develUpgrade kernel-zfcpdump-modules-extraUpgrade python3-perfUpgrade kernel-rt-debug-modules-extraUpgrade kernel-rt-coreUpgrade kernel-debug-coreUpgrade kernel-rt-64k-debug-develUpgrade kernel-64k-modules-coreUpgrade rtlaUpgrade kernel-64k-debug-modules-coreUpgrade kernel-modules-extraUpgrade kernel-rt-develUpgrade rvUpgrade kernel-rt-modulesUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-64k-debug-modulesUpgrade kernel-rt-debug-modules-core | Nov 20, 2025 | Nov 11, 2025 |
| Debian | — | Upgrade linux | Jul 27, 2026 | Jul 27, 2026 |
| Oracle_linux | — | Upgrade kernel | Nov 28, 2025 | Mar 12, 2025 |
| Redhat_linux | — | Upgrade kernelUpgrade kernel-rtNo solution exists | Jul 9, 2025 | Mar 12, 2025 |
| Rocky_linux | — | Upgrade perf-debuginfoUpgrade kernel-rt-debug-develUpgrade kernel-tools-libs-develUpgrade kernel-debug-devel-matchedUpgrade libperf-debuginfoUpgrade perfUpgrade kernel-rt-debug-modules-extraUpgrade kernel-rt-coreUpgrade kernel-devel-matchedUpgrade rvUpgrade kernel-zfcpdump-coreUpgrade kernel-zfcpdump-debuginfoUpgrade python3-perfUpgrade kernel-uki-virt-addonsUpgrade libperfUpgrade kernel-develUpgrade kernel-modules-coreUpgrade kernel-uki-virtUpgrade kernel-rt-debug-modules-coreUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-rt-develUpgrade kernel-debuginfo-common-x86_64Upgrade python3-perf-debuginfoUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-debug-modulesUpgrade kernel-rt-debug-modulesUpgrade kernel-rt-debug-debuginfoUpgrade kernel-rt-modules-extraUpgrade kernel-zfcpdumpUpgrade kernel-debug-develUpgrade kernelUpgrade kernel-debug-modules-coreUpgrade kernel-tools-debuginfoUpgrade kernel-debug-coreUpgrade kernel-rt-modules-coreUpgrade kernel-rtUpgrade kernel-modules-extra-matchedUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-zfcpdump-develUpgrade kernel-rt-modulesUpgrade kernel-rt-debuginfoUpgrade kernel-rt-debug-coreUpgrade kernel-rt-debugUpgrade kernel-debug-uki-virtUpgrade kernel-debug-modules-extraUpgrade kernel-modulesUpgrade kernel-debuginfoUpgrade kernel-toolsUpgrade kernel-modules-extraUpgrade kernel-coreUpgrade kernel-tools-libsUpgrade kernel-zfcpdump-modulesUpgrade kernel-debug-debuginfoUpgrade kernel-debugUpgrade kernel-debuginfo-common-s390xUpgrade rtla | Feb 5, 2026 | Nov 21, 2025 |
| Ubuntu | — | Upgrade linux-image-6.11.0-1014-awsUpgrade linux-image-azure-fde-6.8Upgrade linux-image-lowlatency-64k-hwe-24.04Upgrade linux-image-6.8.0-2028-raspi-realtimeUpgrade linux-image-6.11.0-26-generic-64kUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-6.8.0-1035-awsUpgrade linux-image-oracleUpgrade linux-image-gkeUpgrade linux-image-virtualUpgrade linux-image-6.8.0-78-lowlatency-64kUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-gcp-6.8Upgrade linux-image-lowlatency-hwe-24.04Upgrade linux-image-6.8.0-78-lowlatencyUpgrade linux-image-awsUpgrade linux-image-aws-64k-lts-24.04Upgrade linux-image-azure-lts-24.04Upgrade linux-image-6.8.0-1019-gkeopUpgrade linux-image-6.11.0-1016-oracleUpgrade linux-image-generic-lpaeUpgrade linux-image-oem-22.04Upgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-generic-6.8Upgrade linux-image-generic-64k-6.8Upgrade linux-image-raspi-realtimeUpgrade linux-image-aws-64kUpgrade linux-image-oem-24.04bUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-nvidia-lowlatency-64k-6.8Upgrade linux-image-lowlatency-64kUpgrade linux-image-6.11.0-1013-raspiUpgrade linux-image-6.8.0-1032-oracle-64kUpgrade linux-image-gcp-64k-6.8Upgrade linux-image-6.11.0-1015-azureUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-6.8.0-78-genericUpgrade linux-image-azure-6.8Upgrade linux-image-lowlatency-6.8Upgrade linux-image-nvidia-64k-6.8Upgrade linux-image-realtimeUpgrade linux-image-ibm-6.8Upgrade linux-image-6.11.0-1016-oracle-64kUpgrade linux-image-6.8.0-78-generic-64kUpgrade linux-image-6.11.0-1014-lowlatencyUpgrade linux-image-6.8.0-1035-raspiUpgrade linux-image-ibm-classicUpgrade linux-image-lowlatencyUpgrade linux-image-lowlatency-64k-6.8Upgrade linux-image-6.11.0-26-genericUpgrade linux-image-6.8.0-1035-nvidia-64kUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-6.11.0-1015-gcpUpgrade linux-image-gkeop-6.8Upgrade linux-image-6.8.0-1035-nvidiaUpgrade linux-image-6.8.1-1030-realtimeUpgrade linux-image-raspi-realtime-6.8Upgrade linux-image-6.11.0-1010-realtimeUpgrade linux-image-6.8.0-1034-azureUpgrade linux-image-aws-lts-24.04Upgrade linux-image-gke-6.8Upgrade linux-image-generic-hwe-24.04Upgrade linux-image-raspi-6.8Upgrade linux-image-azureUpgrade linux-image-oem-22.04dUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-nvidia-64kUpgrade linux-image-6.11.0-1022-oemUpgrade linux-image-6.8.0-1032-gkeUpgrade linux-image-oem-22.04aUpgrade linux-image-nvidia-lowlatency-6.8Upgrade linux-image-genericUpgrade linux-image-oem-22.04bUpgrade linux-image-generic-64kUpgrade linux-image-virtual-6.8Upgrade linux-image-raspiUpgrade linux-image-azure-fdeUpgrade linux-image-oracle-lts-24.04Upgrade linux-image-gcpUpgrade linux-image-6.8.0-1034-azure-fdeUpgrade linux-image-kvmUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-aws-64k-6.8Upgrade linux-image-6.8.0-1036-gcpUpgrade linux-image-6.11.0-1015-azure-fdeUpgrade linux-image-aws-6.8Upgrade linux-image-6.8.0-1035-aws-64kUpgrade linux-image-gcp-64kUpgrade linux-image-azure-fde-lts-24.04Upgrade linux-image-oem-22.04cUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-6.8.0-1033-ibmUpgrade linux-image-nvidiaUpgrade linux-image-6.8.0-1036-gcp-64kUpgrade linux-image-realtime-6.8.1Upgrade linux-image-ibmUpgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-oracle-64k-6.8Upgrade linux-image-azure-nvidia-lts-24.04Upgrade linux-image-gkeopUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-nvidia-6.8Upgrade linux-image-6.11.0-1014-lowlatency-64kUpgrade linux-image-azure-nvidia-6.8Upgrade linux-image-6.8.0-1035-nvidia-lowlatencyUpgrade linux-image-6.8.0-1032-oracleUpgrade linux-image-oracle-6.8Upgrade linux-image-6.8.0-1035-nvidia-lowlatency-64kUpgrade linux-image-gcp-lts-24.04Upgrade linux-image-6.11.0-1015-gcp-64kUpgrade linux-image-azure-nvidiaUpgrade linux-image-oracle-64kUpgrade linux-image-6.8.0-1022-azure-nvidia | May 21, 2025 | Mar 12, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub