CVE-2026-98058 bpf: Mark syscall helpers as sleepable

Not scored Published 25 Sep 2026 Updated 21 Oct 2026

A local attacker can trigger a kernel crash by invoking sleepable BPF helpers from atomic contexts, requiring kernel patching.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2026-98058?

CVE-2026-98058 is a denial of service vulnerability in Linux, published on 25 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Mark syscall helpers as sleepable

bpf_sys_bpf() executes the bpf(2) syscall body, which can take mutexes, allocate with GFP_KERNEL, and wait for an RCU grace period. bpf_sys_close() reaches close_fd() and filp_close(), which can sleep as well.

Both helpers are limited to BPF_PROG_TYPE_SYSCALL, whose main program is sleepable. That does not make every callback sleepable: a syscall program can register a bpf_timer callback, and the verifier checks that callback in a non-sleepable context while retaining the syscall helper set.

Without .might_sleep on the prototypes, such a callback can invoke bpf_sys_bpf() from hrtimer softirq context and trigger a scheduling-while-atomic failure. bpf_sys_close() is exposed through the same missing context check.

Set .might_sleep on both prototypes so the existing helper-context check rejects them from timer callbacks and other atomic regions. Calls from the sleepable main body remain valid.

Which versions are affected by CVE-2026-98058?

How do I fix CVE-2026-98058?

Apply the vendor's patch.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-98058 being exploited?

There is no known exploitation of CVE-2026-98058 in the wild and no public exploit code.

Sources

Also known as AZL-104553, BELL-CVE-2026-98058, DEBIAN-CVE-2026-98058, GHSA-24c8-ppg7-5393, UBUNTU-CVE-2026-98058.