CVE-2026-23134 in Linux
Summary
by MITRE • 02/14/2026
In the Linux kernel, the following vulnerability has been resolved:
slab: fix kmalloc_nolock() context check for PREEMPT_RT
On PREEMPT_RT kernels, local_lock becomes a sleeping lock. The current check in kmalloc_nolock() only verifies we're not in NMI or hard IRQ context, but misses the case where preemption is disabled.
When a BPF program runs from a tracepoint with preemption disabled (preempt_count > 0), kmalloc_nolock() proceeds to call local_lock_irqsave() which attempts to acquire a sleeping lock, triggering:
BUG: sleeping function called from invalid context in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 6128 preempt_count: 2, expected: 0
Fix this by checking !preemptible() on PREEMPT_RT, which directly expresses the constraint that we cannot take a sleeping lock when preemption is disabled. This encompasses the previous checks for NMI and hard IRQ contexts while also catching cases where preemption is disabled.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 03/18/2026
The vulnerability identified as CVE-2026-23134 represents a critical concurrency issue within the Linux kernel's memory allocation subsystem, specifically affecting PREEMPT_RT enabled systems. This flaw manifests in the kmalloc_nolock() function which is designed to provide lock-free memory allocation in certain contexts. The issue arises from an inadequate context validation mechanism that fails to account for the specific requirements of real-time kernel configurations where preemption behavior differs significantly from standard kernel operation.
The technical root cause stems from the fundamental architectural differences between standard Linux kernels and PREEMPT_RT kernels. In PREEMPT_RT systems, the local_lock mechanism transitions from a simple spinlock to a sleeping lock that can block execution when resources are unavailable. The original implementation of kmalloc_nolock() only validated for NMI and hard IRQ contexts but neglected to check for preemption-disabled states where the kernel cannot safely acquire sleeping locks. This oversight creates a scenario where BPF programs executing from tracepoints with preemption disabled can trigger the problematic code path, leading to kernel panics and system instability.
The operational impact of this vulnerability is severe particularly in real-time computing environments where PREEMPT_RT is commonly deployed for deterministic behavior requirements. When a BPF program executes from a tracepoint with preemption disabled, the kmalloc_nolock() function incorrectly proceeds to call local_lock_irqsave() which attempts to acquire a sleeping lock in an invalid context. The resulting kernel BUG message clearly indicates the problematic state with in_atomic() returning 1, irqs_disabled() showing 0, and preempt_count displaying 2 instead of the expected 0, demonstrating that the kernel is attempting to sleep while holding atomic context.
This vulnerability directly maps to CWE-367, which addresses Time-of-Check to Time-of-Use (TOCTOU) errors, and relates to ATT&CK technique T1059.006 for execution through BPF programs. The fix implements a more comprehensive context validation by adding a check for !preemptible() on PREEMPT_RT systems, which properly captures all scenarios where sleeping locks cannot be safely acquired. This solution encompasses the previous NMI and hard IRQ context checks while additionally addressing the preemption disabled case, thereby providing complete protection against the kernel panic condition. The mitigation ensures that kmalloc_nolock() will properly refuse to execute when preemption is disabled, preventing the dangerous attempt to acquire sleeping locks in inappropriate contexts and maintaining system stability in real-time kernel environments.
The fix demonstrates proper adherence to kernel security principles by implementing defensive programming techniques that prevent invalid kernel state transitions. This vulnerability highlights the complexity of maintaining compatibility across different kernel configurations while ensuring memory allocation functions operate correctly in all execution contexts. The resolution maintains backward compatibility while strengthening the kernel's robustness against race conditions and invalid lock acquisitions in real-time environments where deterministic behavior is critical for system reliability.