CVE-2025-21728

What it actually does

The vulnerability allows BPF programs executing in non-preemptible contexts to invoke bpf_send_signal() which can sleep, due to an incorrect check using irqs_disabled() instead of !preemptible().

Why it matters to the business

Systems running affected Linux kernels may experience instability, crashes, or unexpected behavior when BPF programs attempt signal delivery in restricted execution contexts, increasing operational risk and potential downtime especially in environments with high BPF usage.

How an attack unfolds

An attacker with local access loads a BPF program that calls bpf_send_signal() while the kernel is in a non-preemptible context; the incorrect check permits the sleeping call, leading to kernel issues. No widespread exploitation by named threat actors has been observed for this specific issue.

How to fix it

Update the Linux kernel to a fixed version such as 5.4.291 or apply the commit feba1308bc5e8e04cee751d39fae8a9b407a9034. For any dependent packages, upgrade to inventree 0.7.2 or later where applicable.

How to confirm the fix worked

Verify the running kernel version against the fixed releases, confirm the presence of the updated check for !preemptible() in the bpf_send_signal implementation, and test BPF programs in non-preemptible contexts to ensure no sleeping calls occur.

Typical attack path

1. Obtain local access to a system running an affected kernel
2. Load a malicious or crafted BPF program that triggers bpf_send_signal() in a non-preemptible context
3. Trigger execution of the program to cause the sleeping call and resulting kernel fault

How to detect it

Review kernel logs for oops, warnings, or panics mentioning bpf_send_signal or sleeping in atomic contexts; inspect loaded BPF programs for signal-related helpers; no specific threat actor indicators tied to this CVE.

What your security team should do

• Prioritize kernel upgrades on all production systems within the next maintenance window
• Audit BPF program usage to identify any relying on signal delivery in restricted contexts
• Monitor for kernel oops or panic logs related to sleeping in atomic contexts