CVE-2026-90299

What it actually does

The flaw allows sleepable BPF tracing or LSM programs to attach to non-kernel targets (other BPF programs) whose symbol names match '__x64_'-style prefixes when CONFIG_FUNCTION_ERROR_INJECTION is disabled, because the verifier skips confirming the target's BTF origin; this permits use of sleepable helpers such as bpf_copy_from_user on an invalid context and triggers a kernel BUG.

Why it matters to the business

Organizations running Linux kernels with custom or third-party BPF programs may experience sudden system crashes or instability during routine network activity, leading to unplanned downtime for services that depend on stable kernel operation.

How an attack unfolds

An attacker authors a sleepable fentry program that targets a BPF program whose name begins with '__x64_', loads the target program (for example an XDP program), attaches it to an interface such as lo, and invokes sleepable helpers; normal traffic (ping) then causes the kernel to execute the tracing program from an invalid context and panic.

How to fix it

Apply the upstream kernel commit that enforces the requirement that a sleepable program's target BTF must be a kernel BTF object; rebuild and deploy the corrected kernel, and avoid loading sleepable tracing programs against non-kernel targets until the fix is present.

How to confirm the fix worked

Confirm the patched verifier contains the explicit check that rejects sleepable attachments unless the target BTF originates from the kernel; attempt to load a sleepable fentry against a user-space-created BPF program and verify the load is denied with an appropriate error.

Typical attack path

1. Create or locate a BPF program whose symbol name matches the '__x64_' prefix
2. Load a sleepable tracing program configured to attach to that target
3. Insert calls to sleepable helpers inside the tracing program
4. Attach the target BPF program to a network interface
5. Generate traffic that causes the target program to execute

How to detect it

Search kernel logs and dmesg output for the exact BUG string 'sleeping function called from invalid context at kernel/bpf/trampoline.c'; correlate with recent loading of BPF programs that contain sleepable helpers or attach to '__x64_'-prefixed symbols.

• BUG: sleeping function called from invalid context at kernel/bpf/trampoline.c:1324

What your security team should do

• Prioritize kernel upgrades that contain the BPF verifier fix for all production systems
• Audit existing BPF program deployments for any sleepable tracing attachments
• Add kernel log monitoring for 'sleeping function called from invalid context' messages originating from bpf/trampoline.c