CVE-2026-93138
High · 7.8CVSS
7.8
EPSS
0.2%
Published
Sep 17, 2026
CISA due date
—
Cloudanix analysis
A timing flaw inside the Linux kernel could let local users crash the system or gain extra privileges by racing how certain internal data gets prepared.
- Exploitation
- Local Privilege
- Attacker needs
- Low Privilege
- Complexity
- Moderate
- Impact
- Full Compromise
- Component
- OS kernel
- Class
- Race Condition
- Remediation
- Patch
- Effort
- Medium
- Patch risk
- Low
What it actually does
A data race in bpf_get_btf_vmlinux allows concurrent first-time callers to observe a pointer to vmlinux BTF before the struct contents and related globals are fully initialized due to missing acquire/release memory ordering.
Why it matters to the business
Local attackers may trigger kernel instability, crashes, or arbitrary code execution on affected systems, risking downtime and full host compromise especially on weakly ordered architectures.
How an attack unfolds
An attacker with local access issues concurrent BPF operations that invoke the lazy BTF parser; on a weakly ordered CPU the reader may dereference the pointer before initialization completes, leading to invalid memory access or information disclosure.
How to fix it
Apply the upstream fix that replaces plain stores/loads with smp_store_release and smp_load_acquire when publishing and reading the BTF pointer; rebuild and deploy updated kernels.
How to confirm the fix worked
Inspect kernel source for the corrected memory ordering primitives around the BTF pointer in bpf_get_btf_vmlinux; run concurrency stress tests exercising BPF verifier paths on target hardware.
Typical attack path
- Obtain local user access on a vulnerable Linux kernel
- Trigger multiple simultaneous calls to bpf_get_btf_vmlinux via BPF program loading
- Exploit missing memory barriers to read partially initialized BTF data
- Leverage resulting invalid memory access for denial of service or privilege escalation
How to detect it
Review kernel logs and dmesg for oopses or warnings involving btf_parse_vmlinux or bpf_get_btf_vmlinux; correlate with processes performing rapid BPF program loads.
What your security team should do
- Expedite deployment of kernels containing the memory-barrier fix
- Restrict unprivileged BPF loading via sysctl until patches are applied
- Monitor kernel logs for BPF-related oops or warnings on production systems
The record
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix vmlinux BTF prep race in bpf_get_btf_vmlinux bpf_get_btf_vmlinux() lazily parses the vmlinux BTF under the bpf_verifier_lock, but publishes the result through a plain store and re-checks it through a plain lockless load. Nothing orders the stores initializing the struct btf inside btf_parse_vmlinux() against the store publishing the pointer: On a weakly ordered arch, a concurrent first-time caller taking the lockless fast path could in principle observe the pointer before the parsed contents are visible. The mutex_unlock() does not help such a reader given it only synchronizes with a later acquisition of the same lock. Thus, publish the pointer with smp_store_release() and read it on the fast path with smp_load_acquire(). Acquire semantics are needed rather than a dependency-ordered READ_ONCE(): btf_parse_vmlinux() also populates globals outside the returned object (e.g. bpf_ctx_convert.t). An address dependency would only order accesses performed through the pointer and not cover other globals.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|