CVE-2024-50138

What it actually does

The __bpf_ringbuf_reserve function used spinlock_t while invoked from a tracepoint that disables preemption; on RT kernels this triggers sleeping in atomic context.

Why it matters to the business

Systems running real-time Linux kernels may experience warnings, instability, or degraded reliability when using BPF ring buffer operations from tracepoints, increasing operational overhead for kernel tracing workloads.

How an attack unfolds

An attacker would need to trigger BPF programs attached to tracepoints that call ringbuf reserve; the condition is a coding error rather than a remotely exploitable flaw and no public exploitation by the listed threat actors has been observed for this specific issue.

How to fix it

Update the Linux kernel to a version containing commit 5eb34999d118e69a20dc0c6556f315fcb0a1f8d3 or later; rebuild and deploy the updated kernel image.

How to confirm the fix worked

Verify the running kernel contains the referenced commit or later; confirm absence of the BUG warning when exercising ringbuf operations under tracepoints on RT kernels.

Typical attack path

1. Load or attach a BPF program that uses ringbuf reserve from a tracepoint context
2. Execute the program on an RT kernel build
3. Observe the sleeping-function-called-from-invalid-context warning

How to detect it

Search kernel logs for the exact BUG message mentioning sleeping function called from invalid context at spinlock_rt.c together with __bpf_ringbuf_reserve and bpf_ringbuf_reserve_dynptr.

• BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c
• __bpf_ringbuf_reserve+0xc4/0x254
• bpf_ringbuf_reserve_dynptr+0x5c/0xdc

What your security team should do

• Prioritize kernel updates on any RT Linux deployments that use BPF tracing
• Monitor for the sleeping-function warning in kernel logs
• Test BPF workloads after applying the fix to confirm resolution