Linux Kernel BPF arena_vm_fault deadlock

Summaryinfo

A vulnerability, which was classified as critical, has been found in Linux Kernel. This issue affects the function arena_vm_fault of the component BPF. The manipulation leads to deadlock. This vulnerability is listed as CVE-2026-90342. The attack may be initiated remotely. There is no available exploit. To fix this issue, it is recommended to deploy a patch.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Linux Kernel (affected version unknown). This issue affects the function arena_vm_fault of the component BPF. The manipulation with an unknown input leads to a deadlock vulnerability. Using CWE to declare the problem leads to CWE-833. The product contains multiple threads or executable segments that are waiting for each other to release a necessary lock, resulting in deadlock. Impacted is availability. The summary by CVE is:

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix mmap_lock deadlock on arena lock failure Reported by the Sashiko AI review. arena_vm_fault() returns VM_FAULT_RETRY when it can't take arena->spinlock, but it never took mmap_lock. The fault path assumes a VM_FAULT_RETRY handler already dropped mmap_lock and re-takes it on the retry, so mmap_lock gets taken twice and can deadlock: do_user_addr_fault() { fault = handle_mm_fault(...); // calls arena_vm_fault() if (fault & VM_FAULT_RETRY) goto retry; // re-locks mmap_lock mmap_read_unlock(mm); } Return VM_FAULT_SIGBUS instead, for two reasons: 1. We could keep VM_FAULT_RETRY, but then we'd have to drop the fault lock first and cap the retry ourselves, the way __folio_lock_or_retry() does. 2. A failed raw_res_spin_lock_irqsave() already means a possible deadlock was detected, so retrying just hits the same lock again. So returning VM_FAULT_RETRY here is overkill.

It is possible to read the advisory at git.kernel.org. The identification of this vulnerability is CVE-2026-90342 since 09/11/2026. The exploitation is known to be easy. The attack may be initiated remotely. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 09/17/2026). The attack technique deployed by this issue is T1499 according to MITRE ATT&CK.

Applying the patch af8087f16714f7620c4db3e732baaa1b2337948f/0b10b945479c954393d62ee3229d2f224a4ca91c is able to eliminate this problem.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion