Linux Kernel up to 7.2.5 BPF Verifier kernel/bpf/trampoline.c race condition

Summaryinfo

A vulnerability classified as problematic was found in Linux Kernel up to 7.2.5. This affects an unknown part of the file kernel/bpf/trampoline.c of the component BPF Verifier. Such manipulation leads to race condition. This vulnerability is documented as CVE-2026-90299. The attack needs to be performed locally. There is not any exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in Linux Kernel up to 7.2.5. It has been rated as problematic. Affected by this issue is an unknown function of the file kernel/bpf/trampoline.c of the component BPF Verifier. The manipulation with an unknown input leads to a race condition vulnerability. Using CWE to declare the problem leads to CWE-362. The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently. Impacted is availability. CVE summarizes:

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix sleepable check for tracing/lsm prog When CONFIG_FUNCTION_ERROR_INJECTION is disabled, a sleepable tracing prog is allowed to attach to '__x64_'-alike prefix symbols. It is because the verifier does not verify whether the symbol is a kernel function or a bpf prog. That said, a sleepable tracing prog is allowed to attach to a bpf prog target whose name has '__x64_'-alike prefix. For example, a sleepable fentry prog attaches to a '__x64_sys_nop' XDP prog, and copies buffer from a user pointer with bpf_copy_from_user() helper. After attaching the XDP prog to lo interface, the kernel BUG could be triggered by 'ping -c 1 -W 1 127.0.0.1': [ 3.460756] BUG: sleeping function called from invalid context at kernel/bpf/trampoline.c:1324 Fix it by disallowing sleepable prog always when its target btf is not a kernel's btf.

The advisory is available at git.kernel.org. This vulnerability is handled as CVE-2026-90299 since 09/11/2026. The exploitation is known to be easy. Local access is required to approach this attack. The exploitation needs additional levels of successful authentication. Technical details are known, but there is no available exploit.

Upgrading to version 7.2.6 or 7.3-rc1 eliminates this vulnerability. Applying the patch 976f1be72740cfbc351d3841fd21186dda3ea723/00244bdaa423d93f4571f3f6854378ce3365e524 is able to eliminate this problem. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 7.2.0
• 7.2.1
• 7.2.2
• 7.2.3
• 7.2.4
• 7.2.5

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion