bpf: Fix vmlinux BTF prep race in bpf_get_btf_vmlinux

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-93138
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-09-17 17:18:08 UTC
Updated2026-09-17 17:18:08 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: bpf: Fix vmlinux BTF prep race in bpf_get_btf_vmlinux bpf_get_btf_vmlinux() lazily parses the vmlinux BTF under the bpf_verifier_lock, but publishes the result through a plain store and re-checks it through a plain lockless load. Nothing orders the stores initializing the struct btf inside btf_parse_vmlinux() against the store publishing the pointer: On a weakly ordered arch, a concurrent first-time caller taking the lockless fast path could in principle observe the pointer before the parsed contents are visible. The mutex_unlock() does not help such a reader given it only synchronizes with a later acquisition of the same lock. Thus, publish the pointer with smp_store_release() and read it on the fast path with smp_load_acquire(). Acquire semantics are needed rather than a dependency-ordered READ_ONCE(): btf_parse_vmlinux() also populates globals outside the returned object (e.g. bpf_ctx_convert.t). An address dependency would only order accesses performed through the pointer and not cover other globals.

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected 8580ac9404f6240668a026785d7d8856f0530409 f32a4a40bc635be25d6816da4bd91e9e58c31bf3 git Not specified
CNA Linux Linux affected 8580ac9404f6240668a026785d7d8856f0530409 a7fe72d780122eb934536f1719abad445f6afdf7 git Not specified
CNA Linux Linux affected 8580ac9404f6240668a026785d7d8856f0530409 e18a10b39c994f04e1ebd7f8fc042bb1ca8ad053 git Not specified
CNA Linux Linux affected 8580ac9404f6240668a026785d7d8856f0530409 978524ecfc1c539282df5858de1eec20748c6f74 git Not specified
CNA Linux Linux affected 8580ac9404f6240668a026785d7d8856f0530409 eaf302628a78806f66d8224d6ba03fb4d5025de4 git Not specified
CNA Linux Linux affected 8580ac9404f6240668a026785d7d8856f0530409 2892f3f44bf865c8fb6b6c0960edec4cc91806ee git Not specified
CNA Linux Linux affected 8580ac9404f6240668a026785d7d8856f0530409 86d11c594d60b255b526fa5260f669463fb1a063 git Not specified
CNA Linux Linux affected 8580ac9404f6240668a026785d7d8856f0530409 92863e678070f57c17c868e4bfa2441a5c61ad2b git Not specified
CNA Linux Linux affected 5.5 Not specified
CNA Linux Linux unaffected 5.5 semver Not specified
CNA Linux Linux unaffected 5.10.270 5.10.* semver Not specified
CNA Linux Linux unaffected 5.15.221 5.15.* semver Not specified
CNA Linux Linux unaffected 6.1.188 6.1.* semver Not specified
CNA Linux Linux unaffected 6.6.157 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.110 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.52 6.18.* semver Not specified
CNA Linux Linux unaffected 7.2.6 7.2.* semver Not specified
CNA Linux Linux unaffected 7.3-rc1 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/86d11c594d60b255b526fa5260f669463fb1a063 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/a7fe72d780122eb934536f1719abad445f6afdf7 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/eaf302628a78806f66d8224d6ba03fb4d5025de4 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/f32a4a40bc635be25d6816da4bd91e9e58c31bf3 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/92863e678070f57c17c868e4bfa2441a5c61ad2b 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/978524ecfc1c539282df5858de1eec20748c6f74 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/e18a10b39c994f04e1ebd7f8fc042bb1ca8ad053 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/2892f3f44bf865c8fb6b6c0960edec4cc91806ee 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report