{"id":25708,"date":"2026-09-18T04:31:46","date_gmt":"2026-09-17T20:31:46","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-90299"},"modified":"2026-09-18T04:31:46","modified_gmt":"2026-09-17T20:31:46","slug":"cve-2026-90299","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-90299","title":{"rendered":"CVE-2026-90299 &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix sleepable ch"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>bpf: Fix sleepable check for tracing\/lsm prog<\/p>\n<p>When CONFIG_FUNCTION_ERROR_INJECTION is disabled, a sleepable tracing prog<br \/>\nis allowed to attach to &#8216;__x64_&#8217;-alike prefix symbols.<\/p>\n<p>It is because the verifier does not verify whether the symbol is a kernel<br \/>\nfunction or a bpf prog. That said, a sleepable tracing prog is allowed to<br \/>\nattach to a bpf prog target whose name has &#8216;__x64_&#8217;-alike prefix.<\/p>\n<p>For example, a sleepable fentry prog attaches to a &#8216;__x64_sys_nop&#8217; XDP<br \/>\nprog, and copies buffer from a user pointer with bpf_copy_from_user()<br \/>\nhelper. After attaching the XDP prog to lo interface, the kernel BUG<br \/>\ncould be triggered by &#8216;ping -c 1 -W 1 127.0.0.1&#8217;:<\/p>\n<p>[    3.460756] BUG: sleeping function called from invalid context at kernel\/bpf\/trampoline.c:1324<\/p>\n<p>Fix it by disallowing sleepable prog always when its target<br \/>\nbtf is not a kernel&#8217;s btf.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>bpf: Fix sleepable check for tracing\/lsm prog<\/p>\n<p>When CONFIG_FUNCTION_ERROR_INJECTION is disabled, a sleepable tracing prog<br \/>\nis allowe<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-25708","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/25708","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25708"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25708"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25708"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}